[BUG] Django Project Misconfiguration

Hi Opensource people,

After getting to know about LearnForFree Project and wanted to contribute to it, I had found few vulnerabilities on the Django project on Misconfiguration of its settings. As Django project, default configuration leads to DEBUG mode = TRUE but we have to look sensible while in production and there is a flaw on this project where it's DEBUG mode = TRUE. It should be FALSE while in production.

Impacts

Talking about impacts on this project, an attacker can obtain credentials

• System Version(Django& Python)
• Database credentials(Username, name, type=SQL/NOSQL)
• Internal file path and details of project configurations

To Reproduce

Steps to reproduce the behavior:

1. Go to 'LearnForFree'
2. Request the URL as LearnForFree/anythinghere
3. You can see the errors and path of the project.
4. See errors

Expected behavior
Instead of previewing the credentials and path of the project, it should redirect to 404 pages.

Start by reviewing the Django project settings and reproduce the reported malformed-URL request against the deployed LearnForFree site. Done means production no longer exposes credentials, paths, or configuration details and the request instead returns a 404 page.