search

quru / qis

Dynamic image server for web and print
https://quruimageserver.com
GNU Affero General Public License v3.0
90 stars 7 forks source link

Hide secrets from error messages #11

Closed fozcode closed 5 years ago

fozcode commented 5 years ago

Some error conditions leak too much information back to the user, e.g. full operating system paths:

{ "status": 500,
  "message": "Internal error ([Errno 13] Permission denied: '/opt/qis/images/published/2018-10-02/night.jpg')" }

In theory it is possible for worse things to leak, e.g. database connection details when the database is down. We should run error messages through a filtering routine before returning them. This can be initially based on the settings in base_settings.py and any other obvious things to filter out.