popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent internal error details leaking in HTTP responses

Browse Source 
Replace err.Error() concatenation in JSON decode error responses with fixed 'invalid request body' message across 5 locations in custom_services.go, discount_campaigns.go, and services.go.
This commit is contained in:
popertots
2026-08-22 00:34:48 +01:00
parent 291868f11a
commit 5ed24f263a
3 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/handlers/admin/custom_services.go
+2 -2
View File
@@ -207,7 +207,7 @@ func GetCustomServices(w http.ResponseWriter, r *http.Request) {
func CreateCustomService(w http.ResponseWriter, r *http.Request) { func CreateCustomService(w http.ResponseWriter, r *http.Request) {
var req CreateCustomServiceRequest var req CreateCustomServiceRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil { if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest) http.Error(w, "invalid request body", http.StatusBadRequest)
return return
} }
if err := validators.Validate.Struct(&req); err != nil { if err := validators.Validate.Struct(&req); err != nil {
@@ -326,7 +326,7 @@ func UpdateCustomService(w http.ResponseWriter, r *http.Request) {
var req UpdateCustomServiceRequest var req UpdateCustomServiceRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil { if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest) http.Error(w, "invalid request body", http.StatusBadRequest)
return return
} }
if err := validators.Validate.Struct(&req); err != nil { if err := validators.Validate.Struct(&req); err != nil {
backend/handlers/admin/discount_campaigns.go
+2 -2
View File
@@ -211,7 +211,7 @@ func GetDiscountCampaigns(w http.ResponseWriter, r *http.Request) {
func CreateDiscountCampaign(w http.ResponseWriter, r *http.Request) { func CreateDiscountCampaign(w http.ResponseWriter, r *http.Request) {
var req CreateCampaignRequest var req CreateCampaignRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil { if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest) http.Error(w, "invalid request body", http.StatusBadRequest)
return return
} }
@@ -417,7 +417,7 @@ func UpdateDiscountCampaign(w http.ResponseWriter, r *http.Request) {
var req UpdateCampaignRequest var req UpdateCampaignRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil { if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest) http.Error(w, "invalid request body", http.StatusBadRequest)
return return
} }
backend/handlers/services/services.go
+1 -2
View File
@@ -101,10 +101,9 @@ func ToggleService(w http.ResponseWriter, r *http.Request) {
// POST /api/admin/services // POST /api/admin/services
func CreateServiceHandler(w http.ResponseWriter, r *http.Request) { func CreateServiceHandler(w http.ResponseWriter, r *http.Request) {
// Parse and validate request
var req CreateServiceRequest var req CreateServiceRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil { if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest) http.Error(w, "invalid request body", http.StatusBadRequest)
return return
} }
if err := validators.Validate.Struct(&req); err != nil { if err := validators.Validate.Struct(&req); err != nil {