From 0e76956a2e43c559ab2cbef5cc1423f6be8e0c83 Mon Sep 17 00:00:00 2001
From: ArtemDemidovAramMeem
 <114488361+ArtemDemidovAramMeem@users.noreply.github.com>
Date: Fri, 14 Apr 2023 19:39:11 +0400
Subject: [PATCH] Override log handler when using sensitive parameters. Closes
 #1010

---
 axes/helpers.py       |  2 +-
 tests/test_helpers.py | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/axes/helpers.py b/axes/helpers.py
index 457354d..778d582 100644
--- a/axes/helpers.py
+++ b/axes/helpers.py
@@ -306,7 +306,7 @@ def get_client_str(
         client_dict = {}
         for client in client_list:
             client_dict.update(client)
-
+    client_dict = cleanse_parameters(client_dict.copy())
     # Path info is always included as last component in the client string for traceability purposes
     if path_info and isinstance(path_info, (tuple, list)):
         path_info = path_info[0]
diff --git a/tests/test_helpers.py b/tests/test_helpers.py
index fc4b5a3..0222d53 100644
--- a/tests/test_helpers.py
+++ b/tests/test_helpers.py
@@ -269,6 +269,26 @@ class ClientStringTestCase(AxesTestCase):
             self.email,
         )
 
+    @override_settings(AXES_SENSITIVE_PARAMETERS=["username"])
+    def test_get_client_str_with_sensitive_parameters(self):
+        username = "test@example.com"
+        ip_address = "127.0.0.1"
+        user_agent = "Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
+        path_info = "/admin/"
+
+        expected = self.get_expected_client_str(
+            "********************",
+            ip_address,
+            user_agent,
+            path_info,
+            self.request
+        )
+        actual = get_client_str(
+            username, ip_address, user_agent, path_info, self.request
+        )
+
+        self.assertEqual(expected, actual)
+
 
 def get_dummy_client_str(username, ip_address, user_agent, path_info, request):
     return "client string"