django-debug-toolbar/django-debug-toolbar — Issue #252: SettingsVarsDebugPanel resolves django settings var value which can lead to calling a setting set to a callable object.
Author: crass
Created: 2012-01-15 11:21:47+00:00
State: open

The settings variable's value is rendered in templates/debug_toolbar/panels/settings_vars.html using `{{ var.1|pprint }}`, where var is a tuple of (settings name, settings value). Django will try to call any callable found in its rendering of a template variable. So if we have a setting defined as `CREATE_USER_FUNC = create_user`, where get_user is a function object, then create_user() will be called while rendering the template. This is certainly not what we want. At best it'll render the `TEMPLATE_STRING_IF_INVALID`, at worst an exception will be thrown or even a user created!

I think the best solution is to change the template from `{{ var.1|pprint }}` to `{{ var|last|pprint }}`. This way pprint gets the value without it getting resolved.