Merge pull request #5903 from learningequality/no_exceptions!

Stop exposing exception details in HTTP responses

Author: bjester

contentcuration/contentcuration/views/subscription.py

@@ -79,9 +79,9 @@ def post(self, request):
 
             return Response({"checkout_url": session.url})
 
-        except stripe.error.StripeError as e:
-            logger.error(f"Stripe error creating checkout session: {e}")
-            return Response({"error": str(e)}, status=400)
+        except stripe.error.StripeError:
+            logger.exception("Stripe error creating checkout session")
+            return Response({"error": "Unable to create checkout session"}, status=400)
 
 
 class CreatePortalSessionView(APIView):
@@ -105,9 +105,9 @@ def post(self, request):
             )
             return Response({"portal_url": session.url})
 
-        except stripe.error.StripeError as e:
-            logger.error(f"Stripe error creating portal session: {e}")
-            return Response({"error": str(e)}, status=400)
+        except stripe.error.StripeError:
+            logger.exception("Stripe error creating portal session")
+            return Response({"error": "Unable to create portal session"}, status=400)
 
 
 class SubscriptionStatusView(APIView):

contentcuration/contentcuration/viewsets/channel.py

@@ -468,8 +468,9 @@ def create(self, request, *args, **kwargs):
         try:
             self.perform_create(serializer)
 
-        except IntegrityError as e:
-            return Response({"error": str(e)}, status=409)
+        except IntegrityError:
+            logging.exception("Integrity error creating channel")
+            return Response({"error": "Channel could not be created"}, status=409)
         instance = serializer.instance
         Change.create_change(
             generate_create_event(