Django: prevent template from using a model method

django

Solution

This is noted in the template API docs: https://docs.djangoproject.com/en/stable/ref/templates/api/#variables-and-lookups

Occasionally you may want to turn off this feature for other reasons, and tell the template system to leave a variable un-called no matter what. To do so, set a do_not_call_in_templates attribute on the callable with the value True. The template system then will act as if your variable is not callable (allowing you to access attributes of the callable, for example).

To do this change your function to have the `do_not_call_in_templates` flag set:

def get_admin_credentials(self):
    return decrypt(self.admin_credentials)
get_admin_credentials.do_not_call_in_templates = True

Problem

I have a Django app which looks something like this: ``` class Server(models.Model): hostname = models.CharField(max_length=100) # this field stores encrypted credentials admin_credentials = models.TextField() def get_admin_credentials(self): return decrypt(self.admin_credentials) ``` Since Django's template language allows templates to call methods (which don't require arguments) of their context variables, it seems way too easy for a template to leak these credentials just by containing the following code: ``` {{ server.get_admin_credentials }} ``` How can I prevent templates from directly using the `get_admin_credentials()` method?

Original source