Skip to content

Commit f065be5

Browse files
committed
fix: Prevent information exposure through exception messages
Replace direct exception message exposure with generic error messages. Log full exception details server-side for debugging while returning safe, generic error messages to users. This addresses CodeQL security warning about information exposure through exceptions.
1 parent 3a50ec9 commit f065be5

File tree

1 file changed

+14
-2
lines changed

1 file changed

+14
-2
lines changed

website/views/organization.py

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1616,8 +1616,20 @@ def sizzle_daily_log(request):
16161616
)
16171617

16181618
except Exception as e:
1619-
messages.error(request, f"An error occurred: {e}")
1620-
return redirect("sizzle")
1619+
# Log full exception details for debugging, but don't expose to users
1620+
logger.error(
1621+
f"Unexpected error in sizzle_daily_log for user {request.user.username if request.user.is_authenticated else 'anonymous'}: {e}",
1622+
exc_info=True,
1623+
)
1624+
# Return appropriate response based on request method
1625+
if request.method == "POST":
1626+
return JsonResponse(
1627+
{"success": False, "message": "An error occurred while processing your request. Please try again."},
1628+
status=500,
1629+
)
1630+
else:
1631+
messages.error(request, "An error occurred. Please try again.")
1632+
return redirect("sizzle")
16211633

16221634
return HttpResponseBadRequest("Invalid request method.")
16231635

0 commit comments

Comments
 (0)