From a6790891f9b8f46abbebbd8ee0e57e018b016ba0 Mon Sep 17 00:00:00 2001 From: Chuck <33324927+ChuckBuilds@users.noreply.github.com> Date: Mon, 14 Sep 2026 18:48:13 -0400 Subject: [PATCH] fix(auto-update): keep error detail in the status route's 500 test_web_error_detail requires every 5xx handler to log the traceback and return describe_exception(e), which redacts credentials, so failures are diagnosable from the web UI. Dropping it for CodeQL broke that policy. Co-Authored-By: Claude Opus 5 --- web_interface/blueprints/api_v3/system.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/web_interface/blueprints/api_v3/system.py b/web_interface/blueprints/api_v3/system.py index a0eb3370..f18fe968 100644 --- a/web_interface/blueprints/api_v3/system.py +++ b/web_interface/blueprints/api_v3/system.py @@ -129,11 +129,12 @@ def get_auto_update_status(): try: config = api_v3.config_manager.load_config() if api_v3.config_manager else {} return jsonify({'status': 'success', 'data': auto_update.describe_status(config)}) - except Exception: - # Details stay in the log: exception text can carry file paths. + except Exception as e: + # describe_exception redacts credentials; the detail is kept on purpose + # (see test_web_error_detail.py) so a failure is diagnosable from the UI. logger.error("get_auto_update_status failed", exc_info=True) - return jsonify({'status': 'error', - 'message': 'Could not read automatic update status; see logs for details'}), 500 + return jsonify({'status': 'error', 'message': 'Could not read automatic update status', + 'details': describe_exception(e)}), 500 @api_v3.route('/system/auto-update/dismiss', methods=['POST'])