python - Django: information leakage problem when using @login_required and setting LOGIN_URL -

i found form of information leakage when using @login_required decorator , setting login_url variable.

i have site requires mandatory login content. problem redirected login page next variable set when it's existing page.

so when not logged in , asking for:

 http://localhost:8000/validurl/ 

you see this:

 http://localhost:8000/login/?next=/validurl/ 

and when requesting non existing page:

 http://localhost:8000/faultyurl/ 

you see this:

 http://localhost:8000/login/ 

which reveals information dont want. thought of overriding login method, forcing next empty , calling 'super' on subclassed method.

an additional problem of tests fail without login_url set. redirect '/accounts/login/' instead of '/login/'. hence why i'd use login_url disable 'auto next' feature.

anybody can shed light on subject?

thanx lot.

gerard.

you can include line last pattern in urls.py file. re-route urls not match other pattern login page.

urlpatterns = patterns('',      ...      (r'^(?p<path>.+)$', 'django.views.generic.simple.redirect_to', {         'url': '/login/?next=/%(path)s',          'permanent': false     }), ) 

edit: keep raising 404 pages authenticated users, following:

from django.http import http404, httpresponseredirect def fake_redirect(request, path):     if request.user.is_authenticated:         raise http404()     else:         return httpresponseredirect('/login/?next=/%s' % path)  urlpatterns = patterns('',      ...      (r'^(?p<path>.+)$', fake_redirect), )