Ticket #7472: 7472-2.patch

django/core/handlers/base.py

@@ -124 +124 @@
             else:
                 # When DEBUG is False, send an error message to the admins.
                 subject = 'Error (%s IP): %s' % ((request.META.get('REMOTE_ADDR') in settings.INTERNAL_IPS and 'internal' or 'EXTERNAL'), request.path)
-                try:
-                    request_repr = repr(request)
-                except:
-                    request_repr = "Request repr() unavailable"
+                if request.is_secure():
+                    request_repr = "Request details omitted because HTTPS was used."
+                else:
+                    try:
+                        request_repr = repr(request)
+                    except:
+                        request_repr = "Request repr() unavailable"
                 message = "%s\n\n%s" % (self._get_traceback(exc_info), request_repr)
                 mail_admins(subject, message, fail_silently=True)
                 # Return an HttpResponse that displays a friendly error message.

django/middleware/common.py

@@ -96 +96 @@
                 is_internal = _is_internal_request(domain, referer)
                 path = request.get_full_path()
                 if referer and not _is_ignorable_404(path) and (is_internal or '?' not in referer):
-                    ua = request.META.get('HTTP_USER_AGENT', '<none>')
-                    ip = request.META.get('REMOTE_ADDR', '<none>')
+                    if request.is_secure():
+                        message = "Request details omitted because HTTPS was used."
+                    else:
+                        ua = request.META.get('HTTP_USER_AGENT', '<none>')
+                        ip = request.META.get('REMOTE_ADDR', '<none>')
+                        message = "Referrer: %s\nRequested URL: %s\nUser agent: %s\nIP address: %s\n" \
+                            % (referer, request.get_full_path(), ua, ip)
                     mail_managers("Broken %slink on %s" % ((is_internal and 'INTERNAL ' or ''), domain),
-                        "Referrer: %s\nRequested URL: %s\nUser agent: %s\nIP address: %s\n" \
-                                  % (referer, request.get_full_path(), ua, ip))
+                        message)
                 return response
 
         # Use ETags, if requested.

docs/settings.txt

@@ -1239 +1239 @@
 
 To disable this behavior, just remove all entries from the ``ADMINS`` setting.
 
+The notification email contains information about the request which triggered
+the error, including GET data, POST data, cookies and other headers. If the
+request was made over HTTPS, this information is omitted for security reasons.
+
 404 errors
 ----------
 
@@ -1259 +1263 @@
 be reported. Neither will any URL starting with ``/phpmyadmin/``.
 
 To disable this behavior, just remove all entries from the ``MANAGERS`` setting.
+
+The notification email contains information about the request which triggered
+the 404, including the referer, user agent and client IP. If the request was
+made over HTTPS, this information is omitted for security reasons.