Error page should not display user controllable message if possible

[LukasReschke]

/index.php/apps/gallery/error should not show an user-controllable error message if possible, the reason behind this is that users usually trust the response returned by a server. This is also known as Content Spoofing.

Example: http://localhost/master/index.php/apps/gallery/error?message=Please%20send%20your%20password%20to%20owncloud%40evil.de&code=500

[oparoz]

So just remove the error message altogether and let the user sort it out by looking at logs?

[LukasReschke]

So just remove the error message altogether and let the user sort it out by looking at logs?

Or you use ICrypto to generate an encrypted error message and decrypt it :-)

[oparoz]

OK

[oparoz]

Should I put the password in the session?

[LukasReschke]

oparoz added the ready label 9 hours ago

Can you explain what the "ready" label means? :-)

Should I put the password in the session?

Fair point. An secret per session might make sense. But then we're also at a point where we could just put the whole error in the session and read it from there and once it is displayed clean it out of there?

[oparoz]

Can you explain what the "ready" label means? :-)

Kanban: Ready, In progress, On hold
Ready issues have been accepted and will be worked on next

But then we're also at a point where we could just put the whole error in the session and read it from there and once it is displayed clean it out of there?

Yes, that should work. Send to template and remove from session.

[oparoz]

Fix is in #301