Hide lowercase sensitive setting

[François Freitag]

Django provides a cleanse_setting method[1] that prevents sensitive information from being displayed (for example with the diffsettings command).

cleanse_settings relies on a case-sensitive regular expression, HIDDEN_SETTINGS [2].
Making HIDDEN_SETTINGS case-insensitive would be useful to prevent password to be shown.

1: ​https://github.com/django/django/blob/9332497701f2c69bf0bb6d38ce59a51ca7abe78d/django/views/debug.py#L40-L62
2: ​https://github.com/django/django/blob/9332497701f2c69bf0bb6d38ce59a51ca7abe78d/django/views/debug.py#L22

[François Freitag]

Corresponding PR: ​https://github.com/django/django/pull/6122

[Tim Graham]

I don't see any downside. On the other hand, the convention is to use uppercase names for settings so is the only way to encounter this if you're defining your own lower case settings?

[François Freitag]

That's correct. Something like this was defined:

RABBITMQ = {
    'host': 'localhost',
    'login': 'guest',
    'password': 'guest',
}

I was surprised to see that DATABASES password was hidden, but not RABBITMQ.

[Tim Graham]

Okay, please uncheck "Needs tests" on this ticket when you add one to the pull request. Thanks.

[Tim Graham <timograham@…>]

In 16a88b44:

Fixed #26209 -- Masked sensitive settings in debug reports regardless of case.