fix(security): replace str(e) in viewsets/contentnode.py, channel.py, user.py error lists with static messages (pattern 3)

Fixes Pattern 3 across all remaining viewsets. Also chains ValidationError
with from e in validate_completion_criteria, and normalises the
_handle_relationship_changes error value to a list for consistency.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: rtibblesbot

contentcuration/contentcuration/viewsets/channel.py

@@ -561,7 +561,7 @@ def publish_from_changes(self, changes):
                 )
             except Exception as e:
                 log_sync_exception(e, user=self.request.user, change=publish)
-                publish["errors"] = [str(e)]
+                publish["errors"] = ["Internal server error"]
                 errors.append(publish)
         return errors
 
@@ -651,7 +651,7 @@ def publish_next_from_changes(self, changes):
                 )
             except Exception as e:
                 log_sync_exception(e, user=self.request.user, change=publish)
-                publish["errors"] = [str(e)]
+                publish["errors"] = ["Internal server error"]
                 errors.append(publish)
         return errors
 
@@ -709,7 +709,7 @@ def sync_from_changes(self, changes):
                 )
             except Exception as e:
                 log_sync_exception(e, user=self.request.user, change=sync)
-                sync["errors"] = [str(e)]
+                sync["errors"] = ["Internal server error"]
                 errors.append(sync)
         return errors
 
@@ -760,7 +760,7 @@ def deploy_from_changes(self, changes):
                 self.deploy(self.request.user, deploy["key"])
             except Exception as e:
                 log_sync_exception(e, user=self.request.user, change=deploy)
-                deploy["errors"] = [str(e)]
+                deploy["errors"] = ["Internal server error"]
                 errors.append(deploy)
         return errors
 
@@ -814,7 +814,7 @@ def add_to_community_library_from_changes(self, changes):
                 )
             except Exception as e:
                 log_sync_exception(e, user=self.request.user, change=change)
-                change["errors"] = [str(e)]
+                change["errors"] = ["Internal server error"]
                 errors.append(change)
         return errors
 

contentcuration/contentcuration/viewsets/contentnode.py

@@ -1,4 +1,5 @@
 import json
+import logging
 from functools import partial
 from functools import reduce
 
@@ -81,6 +82,8 @@
 from contentcuration.viewsets.sync.utils import generate_update_event
 from contentcuration.viewsets.sync.utils import log_sync_exception
 
+logger = logging.getLogger(__name__)
+
 channel_query = Channel.objects.filter(main_tree__tree_id=OuterRef("tree_id"))
 
 
@@ -477,7 +480,7 @@ def _check_completion_criteria(self, kind, complete, validated_data):
                     completion_criteria, kind
                 )
         except DjangoValidationError as e:
-            raise ValidationError(e)
+            raise ValidationError("Invalid completion criteria") from e
 
     def _ensure_complete(self, instance):
         """
@@ -713,9 +716,10 @@ def _handle_relationship_changes(self, changes):
         # In Django 2.2 add ignore_conflicts to make this fool proof
         try:
             self._execute_changes(change_type, data)
-        except IntegrityError as e:
+        except IntegrityError:
+            logger.exception("_handle_relationship_changes IntegrityError")
             for change in valid_changes:
-                change.update({"errors": str(e)})
+                change.update({"errors": ["Internal server error"]})
                 errors.append(change)
 
         return errors or None
@@ -1067,8 +1071,7 @@ def move(self, pk, target=None, position=None):
         try:
             contentnode = self.get_edit_queryset().get(pk=pk)
         except ContentNode.DoesNotExist:
-            error = ValidationError("Specified node does not exist")
-            return str(error)
+            return "Specified node does not exist"
 
         try:
             target, position = self.validate_targeting_args(target, position)
@@ -1079,8 +1082,9 @@ def move(self, pk, target=None, position=None):
             )
 
             return None
-        except ValidationError as e:
-            return str(e)
+        except ValidationError:
+            logger.exception("move validation error for pk=%s", pk)
+            return "Validation error"
 
     def copy_from_changes(self, changes):
         errors = []
@@ -1091,7 +1095,7 @@ def copy_from_changes(self, changes):
                 self.copy(copy["key"], **copy)
             except Exception as e:
                 log_sync_exception(e, user=self.request.user, change=copy)
-                copy["errors"] = [str(e)]
+                copy["errors"] = ["Internal server error"]
                 errors.append(copy)
                 failed_copy_node = self.get_queryset().filter(pk=copy["key"]).first()
                 if failed_copy_node is not None:
@@ -1196,6 +1200,6 @@ def update_descendants_from_changes(self, changes):
                 errors += change_errors
             except Exception as e:
                 log_sync_exception(e, user=self.request.user, change=change)
-                change["errors"] = [str(e)]
+                change["errors"] = ["Internal server error"]
                 errors.append(change)
         return errors

contentcuration/contentcuration/viewsets/user.py

@@ -1,3 +1,4 @@
+import logging
 from functools import reduce
 
 from django.db import IntegrityError
@@ -45,6 +46,9 @@
 from contentcuration.viewsets.sync.constants import VIEWER_M2M
 
 
+logger = logging.getLogger(__name__)
+
+
 class IsAdminUser(BasePermission):
     """
     Our custom permission to check admin authorization.
@@ -284,9 +288,10 @@ def _handle_relationship_changes(self, changes):
         # In Django 2.2 add ignore_conflicts to make this fool proof
         try:
             self._execute_changes(table, change_type, data)
-        except IntegrityError as e:
+        except IntegrityError:
+            logger.exception("_handle_relationship_changes IntegrityError")
             for change in valid_changes:
-                change.update({"errors": str(e)})
+                change.update({"errors": ["Internal server error"]})
                 errors.append(change)
 
         for change in invalid_changes: