Fixed #19866 -- Added security logger and return 400 for SuspiciousOperation.

SuspiciousOperations have been differentiated into subclasses, and
are now logged to a 'django.security.*' logger. SuspiciousOperations
that reach django.core.handlers.base.BaseHandler will now return a 400
instead of a 500.

Thanks to tiwoc for the report, and Carl Meyer and Donald Stufft
for review.

1 files changed, 20 insertions, 0 deletions

diff --git a/django/test/utils.py b/django/test/utils.py
index fb9221d25c..d178c9b29c 100644
--- a/django/test/utils.py
+++ b/django/test/utils.py
@@ -1,3 +1,5 @@
+from contextlib import contextmanager
+import logging
 import re
 import sys
 import warnings
@@ -401,3 +403,21 @@ class IgnoreDeprecationWarningsMixin(object):
 class IgnorePendingDeprecationWarningsMixin(IgnoreDeprecationWarningsMixin):
 
         warning_class = PendingDeprecationWarning
+
+
+@contextmanager
+def patch_logger(logger_name, log_level):
+    """
+    Context manager that takes a named logger and the logging level
+    and provides a simple mock-like list of messages received
+    """
+    calls = []
+    def replacement(msg):
+        calls.append(msg)
+    logger = logging.getLogger(logger_name)
+    orig = getattr(logger, log_level)
+    setattr(logger, log_level, replacement)
+    try:
+        yield calls
+    finally:
+        setattr(logger, log_level, orig)