[patch] Modify debug.py to show database queries on 500 errors

[Simon Greenhill, dev@…]

Patch to list any database queries that have been executed ( i.e. stored in django.db.connection.queries ) in a 500 Internal Server Error.

[Malcolm Tredinnick]

Maybe we just want to trim this to the last three, five or ten queries? The connection.queries list could be hundreds of elements long, even in development.

[Adrian Holovaty]

I'm not sure this is a good idea: it's a possible security hole. I've seen way too many public-facing Django sites with DEBUG set to True, which gives the public access to the debug pages, so I'd rather not display raw database queries in the debug error pages.

Maybe, as a compromise, the queries could be displayed only for requests from localhost? Or would that defeat the purpose?

[Simon Greenhill, dev@…]

Adrian: I didn't think of that, but the entire Debug output is a security hole on a production website anyway - path info, cookie info, session id's, the region of code that died, etc are all listed. If anyone's stupid enough to run a production website with Debug turned on, then they kind of deserve what they get.

However, either locking it down to localhost only, or maybe have a setting to enable it (default -> disabled)?

[Adrian Holovaty]

Closing because it's too much of a possible security hole.