mirror of https://github.com/zulip/zulip.git
f5a65846a8
As detailed in the comments, the default behavior is undesirable for us because we can't really predict all possibilities of exceptions that may be raised - and thus putting str(e) in the http response is potentially insecure as it may leak some unexpected sensitive information that was in the exception. As a hypothetical example - KeyError resulting from some buggy some_dict[secret_string] call would leak information. Though of course we aim to never write code like that. |
||
---|---|---|
.. | ||
jinja2 | ||
__init__.py | ||
backends.py | ||
computed_settings.py | ||
config.py | ||
configured_settings.py | ||
default_settings.py | ||
dev_settings.py | ||
dev_urls.py | ||
email_backends.py | ||
legacy_urls.py | ||
prod_settings.pyi | ||
prod_settings_template.py | ||
sentry.py | ||
settings.py | ||
terms.md.template | ||
test_extra_settings.py | ||
test_settings.py | ||
urls.py | ||
wsgi.py |