From 5ed24f263a2e827beeed421aaaca44afc96d04b8 Mon Sep 17 00:00:00 2001
From: Stephen Adamson <popertots@gmail.com>
Date: Wed, 29 Jul 2026 23:31:52 +0100
Subject: [PATCH] fix: prevent internal error details leaking in HTTP responses

Replace err.Error() concatenation in JSON decode error responses with fixed 'invalid request body' message across 5 locations in custom_services.go, discount_campaigns.go, and services.go.
---
 backend/handlers/admin/custom_services.go    | 4 ++--
 backend/handlers/admin/discount_campaigns.go | 4 ++--
 backend/handlers/services/services.go        | 3 +--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/backend/handlers/admin/custom_services.go b/backend/handlers/admin/custom_services.go
index 4c67790..76b2820 100644
--- a/backend/handlers/admin/custom_services.go
+++ b/backend/handlers/admin/custom_services.go
@@ -207,7 +207,7 @@ func GetCustomServices(w http.ResponseWriter, r *http.Request) {
 func CreateCustomService(w http.ResponseWriter, r *http.Request) {
 	var req CreateCustomServiceRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
+		http.Error(w, "invalid request body", http.StatusBadRequest)
 		return
 	}
 	if err := validators.Validate.Struct(&req); err != nil {
@@ -326,7 +326,7 @@ func UpdateCustomService(w http.ResponseWriter, r *http.Request) {
 
 	var req UpdateCustomServiceRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
+		http.Error(w, "invalid request body", http.StatusBadRequest)
 		return
 	}
 	if err := validators.Validate.Struct(&req); err != nil {
diff --git a/backend/handlers/admin/discount_campaigns.go b/backend/handlers/admin/discount_campaigns.go
index f931260..fd034ea 100644
--- a/backend/handlers/admin/discount_campaigns.go
+++ b/backend/handlers/admin/discount_campaigns.go
@@ -211,7 +211,7 @@ func GetDiscountCampaigns(w http.ResponseWriter, r *http.Request) {
 func CreateDiscountCampaign(w http.ResponseWriter, r *http.Request) {
 	var req CreateCampaignRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
+		http.Error(w, "invalid request body", http.StatusBadRequest)
 		return
 	}
 
@@ -417,7 +417,7 @@ func UpdateDiscountCampaign(w http.ResponseWriter, r *http.Request) {
 
 	var req UpdateCampaignRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
+		http.Error(w, "invalid request body", http.StatusBadRequest)
 		return
 	}
 
diff --git a/backend/handlers/services/services.go b/backend/handlers/services/services.go
index eff5a8e..57489e5 100644
--- a/backend/handlers/services/services.go
+++ b/backend/handlers/services/services.go
@@ -101,10 +101,9 @@ func ToggleService(w http.ResponseWriter, r *http.Request) {
 
 // POST /api/admin/services
 func CreateServiceHandler(w http.ResponseWriter, r *http.Request) {
-	// Parse and validate request
 	var req CreateServiceRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
+		http.Error(w, "invalid request body", http.StatusBadRequest)
 		return
 	}
 	if err := validators.Validate.Struct(&req); err != nil {