fix(security): replace str(e) and user-input echoes in HTTP responses with static messages#5918

Merged

rtibbles merged 8 commits into

learningequality:hotfixesfrom

rtibblesbot:issue-5916-c9d686

May 26, 2026

Commits on May 16, 2026

test: add security tests for stack-trace exposure and reflective-xss patterns

rtibblesbot
and
claude
committed
fix(security): replace str(e) and user-input echo in views/internal.py response bodies

rtibblesbot
and
claude
committed
fix(security): add content_type=text/plain and remove user-input echo from views/base, views/users, views/nodes

rtibblesbot
and
claude
committed
fix(security): replace str(e) in viewsets/base.py change error lists and JSON error body with static messages (patterns 1+3)

rtibblesbot
and
claude
committed
fix(security): replace str(e) in viewsets/contentnode.py, channel.py, user.py error lists with static messages (pattern 3)

rtibblesbot
and
claude
committed
fix(security): drop str(exc) from pagination NotFound message to prevent exception text leakage

rtibblesbot
and
claude
committed
fix(security): propagate ValidationError detail in publish_next_from_changes

rtibblesbot
and
claude
committed

Commits on May 17, 2026

fix(review): address rtibbles feedback — remove tests, fix pagination, improve IntegrityError message

rtibblesbot
and
claude
committed