Fix code scanning alert no. 3: Information exposure through an exception

weblate_web/views.py

@@ -20,6 +20,7 @@
 from __future__ import annotations
 
 import json
+import logging
 import random
 
 import django.views.defaults
@@ -99,23 +100,23 @@
         # Insert "smart" pagination links, so that there are always ON_ENDS
         # links at either end of the list of pages, and there are always
         # ON_EACH_SIDE links at either end of the "current page" link.
         page_range = []
         if page_num > (ON_EACH_SIDE + ON_ENDS):
             page_range += [
                 *range(ON_ENDS),
                 DOT,
                 *range(page_num - ON_EACH_SIDE, page_num + 1),
             ]
         else:
             page_range.extend(range(page_num + 1))
         if page_num < (num_pages - ON_EACH_SIDE - ON_ENDS - 1):
             page_range += [
                 *range(page_num + 1, page_num + ON_EACH_SIDE + 1),
                 DOT,
                 *range(num_pages - ON_ENDS, num_pages),
             ]
         else:
             page_range.extend(range(page_num + 1, num_pages))
     return [page + 1 if isinstance(page, int) else page for page in page_range]
 
 
@@ -146,7 +147,7 @@
     try:
         payload = loads(
             request.POST.get("payload", ""),
             key=settings.PAYMENT_SECRET,
             max_age=300,
             salt="weblate.user",
         )
@@ -181,12 +182,15 @@
     try:
         payload = loads(
             request.POST.get("payload", ""),
             key=settings.PAYMENT_SECRET,
             max_age=300,
             salt="weblate.hosted",
         )
     except (BadSignature, SignatureExpired) as error:
-        return HttpResponseBadRequest(str(error))
+        logging.exception("Error processing payment payload: %s", error)
+        return HttpResponseBadRequest(
+            "An error occurred while processing your request."
+        )
 
     # Get/create service for this billing
     service = Service.objects.get_or_create(hosted_billing=payload["billing"])[0]
@@ -210,7 +214,7 @@
             subscription.save(update_fields=["package"])
         if subscription.payment and subscription.payment != payments[-1]:
             # Include current payment in past payments
             subscription.pastpayment_set.get_or_create(payment=subscription.payment_obj)
 
             # Update current subscription payment
             subscription.payment = payments[-1]
@@ -218,7 +222,7 @@
 
         # Link past payments
         for payment in payments[:-1]:
             subscription.pastpayment_set.get_or_create(payment=payment)
 
     # Link users which are supposed to have access
     for user in payload["users"]:
@@ -397,7 +401,7 @@
 
 
 class CustomerView(PaymentView):
     form_class = CustomerForm
     template_name = "payment/customer.html"
     check_customer = False