Repository: jazzband/django-axes
Pull request #1032 (2023-04-14 12:57:13)

Bump tox from 4.4.11 to 4.4.12
Bumps [tox](https://github.com/tox-dev/tox) from 4.4.11 to 4.4.12.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/tox-dev/tox/releases">tox's releases</a>.</em></p>
<blockquote>
<h2>4.4.12</h2>
<h2>What's Changed</h2>
<ul>
<li>Avoid race conditions in tests using the demo_pkg_inline fixture by <a href="https://github.com/hroncok"><code>@​hroncok</code></a> in <a href="https://redirect.github.com/tox-dev/tox/pull/2986">tox-dev/tox#2986</a></li>
<li>Bump deps and tools by <a href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/tox/pull/2981">tox-dev/tox#2981</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/tox/compare/4.4.11...4.4.12">https://github.com/tox-dev/tox/compare/4.4.11...4.4.12</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/tox-dev/tox/blob/main/docs/changelog.rst">tox's changelog</a>.</em></p>
<blockquote>
<h2>v4.4.12 (2023-04-13)</h2>
<p>Bugfixes - 4.4.12</p>
<pre><code>- Avoid race conditions in tests using the ``demo_pkg_inline`` fixture. (:issue:`2985`)
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/tox-dev/tox/commit/0d85bdb9122a525cf879437c3287fb552efeb2a7"><code>0d85bdb</code></a> release 4.4.12</li>
<li><a href="https://github.com/tox-dev/tox/commit/bc6bc6a2e5ac608d9c6f0de5810a619a31fd101f"><code>bc6bc6a</code></a> Bump deps and tools (<a href="https://redirect.github.com/tox-dev/tox/issues/2981">#2981</a>)</li>
<li><a href="https://github.com/tox-dev/tox/commit/02901007d8fba21de4ebc486f9692c56c8728af8"><code>0290100</code></a> Avoid race conditions in tests using the demo_pkg_inline fixture (<a href="https://redirect.github.com/tox-dev/tox/issues/2986">#2986</a>)</li>
<li>See full diff in <a href="https://github.com/tox-dev/tox/compare/4.4.11...4.4.12">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tox&package-manager=pip&previous-version=4.4.11&new-version=4.4.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

codecov[bot]: ## [Codecov](https://codecov.io/gh/jazzband/django-axes/pull/1032?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=jazzband) Report
> Merging [#1032](https://codecov.io/gh/jazzband/django-axes/pull/1032?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=jazzband) (eeb31bc) into [master](https://codecov.io/gh/jazzband/django-axes/commit/d3fc47b05b8d9cd552a744f051537e3fe68eb3f4?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=jazzband) (d3fc47b) will **increase** coverage by `0.28%`.
> The diff coverage is `n/a`.

```diff
@@            Coverage Diff             @@
##           master    #1032      +/-   ##
==========================================
+ Coverage   95.92%   96.20%   +0.28%     
==========================================
  Files          34       34              
  Lines        1054     1054              
  Branches      188      188              
==========================================
+ Hits         1011     1014       +3     
+ Misses         37       34       -3     
  Partials        6        6              
```


[see 1 file with indirect coverage changes](https://codecov.io/gh/jazzband/django-axes/pull/1032/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=jazzband)

:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=jazzband)


Patch:
diff --git a/CHANGES.rst b/CHANGES.rst
index ac112c0..4b1f787 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -3,6 +3,11 @@ Changes
 =======
 
 
+5.41.1 (2023-04-16)
+-------------------
+
+- Fix sensitive parameter logging for database handler. [stereodamage]
+
 5.41.0 (2023-04-02)
 -------------------
 
diff --git a/axes/helpers.py b/axes/helpers.py
index 457354d..778d582 100644
--- a/axes/helpers.py
+++ b/axes/helpers.py
@@ -306,7 +306,7 @@ def get_client_str(
         client_dict = {}
         for client in client_list:
             client_dict.update(client)
-
+    client_dict = cleanse_parameters(client_dict.copy())
     # Path info is always included as last component in the client string for traceability purposes
     if path_info and isinstance(path_info, (tuple, list)):
         path_info = path_info[0]
diff --git a/requirements.txt b/requirements.txt
index e9a40db..7fdd048 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,4 +2,4 @@
 -r requirements-qa.txt
 -r requirements-test.txt
 sphinx_rtd_theme==1.2.0
-tox==4.4.11
+tox==4.4.12


Test patch:
diff --git a/tests/test_helpers.py b/tests/test_helpers.py
index fc4b5a3..0222d53 100644
--- a/tests/test_helpers.py
+++ b/tests/test_helpers.py
@@ -269,6 +269,26 @@ class ClientStringTestCase(AxesTestCase):
             self.email,
         )
 
+    @override_settings(AXES_SENSITIVE_PARAMETERS=["username"])
+    def test_get_client_str_with_sensitive_parameters(self):
+        username = "test@example.com"
+        ip_address = "127.0.0.1"
+        user_agent = "Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
+        path_info = "/admin/"
+
+        expected = self.get_expected_client_str(
+            "********************",
+            ip_address,
+            user_agent,
+            path_info,
+            self.request
+        )
+        actual = get_client_str(
+            username, ip_address, user_agent, path_info, self.request
+        )
+
+        self.assertEqual(expected, actual)
+
 
 def get_dummy_client_str(username, ip_address, user_agent, path_info, request):
     return "client string"