Repository: jazzband/django-axes (python)

Issue:
`AXES_SENSITIVE_PARAMETERS` doesn't affect database handler logs
Hello!
I encountered an issue when attempting to utilize the `AXES_SENSITIVE_PARAMETERS` configuration in order to prevent usernames from being written into our log files, even though I added the setting like so:
```python
AXES_SENSITIVE_PARAMETERS = ["username"]
```
Whenever a login attempt fails a log is still being written:
![image](https://user-images.githubusercontent.com/107052238/221629353-c4cf3263-4e21-4565-941d-f0846bc9843e.png)

I might've misunderstood how it works, but I did some debugging and found the following:
1. Inside `axes.handlers.database.py` some of the WARN logs are being written using the `client_str` variable
2. The `client_str` variable is produced from the `get_client_str` function in `axes.helpers.py`
3. In `get_client_str`, lines 298-302 should be replaced with a call to `get_query_str`, which does the same thing but also "cleanses" the dictionary, using the `AXES_SENSITIVE_PARAMETERS ` configuration value.

I'd love some feedback whether I misunderstood the usage of this configuration, or is this an actual issue,
Thanks! Shai.

Pull request:
Override log handler when using sensitive parameters.
Closes #1010.

Not quite sure if it was needed in `AXES_VERBOSE` mode only, so made the changes afterwards.

Patch:
diff --git a/axes/helpers.py b/axes/helpers.py
index 457354d..778d582 100644
--- a/axes/helpers.py
+++ b/axes/helpers.py
@@ -306,7 +306,7 @@ def get_client_str(
         client_dict = {}
         for client in client_list:
             client_dict.update(client)
-
+    client_dict = cleanse_parameters(client_dict.copy())
     # Path info is always included as last component in the client string for traceability purposes
     if path_info and isinstance(path_info, (tuple, list)):
         path_info = path_info[0]


Test patch:
diff --git a/tests/test_helpers.py b/tests/test_helpers.py
index fc4b5a3..0222d53 100644
--- a/tests/test_helpers.py
+++ b/tests/test_helpers.py
@@ -269,6 +269,26 @@ class ClientStringTestCase(AxesTestCase):
             self.email,
         )
 
+    @override_settings(AXES_SENSITIVE_PARAMETERS=["username"])
+    def test_get_client_str_with_sensitive_parameters(self):
+        username = "test@example.com"
+        ip_address = "127.0.0.1"
+        user_agent = "Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
+        path_info = "/admin/"
+
+        expected = self.get_expected_client_str(
+            "********************",
+            ip_address,
+            user_agent,
+            path_info,
+            self.request
+        )
+        actual = get_client_str(
+            username, ip_address, user_agent, path_info, self.request
+        )
+
+        self.assertEqual(expected, actual)
+
 
 def get_dummy_client_str(username, ip_address, user_agent, path_info, request):
     return "client string"