feat(xo-server/api): don't filters error sent to admin users (#6262)

Previous behavior was hiding all errors not explicitly dedicated to be sent to API users and replacing them with an *unknown error from the peer*.

This was done to avoid leaking sensitive information, but it often hides important info.

Administrators can already see the raw errors in Settings/Logs, therefore it makes sense to not hide them for these users.
This commit is contained in:
Julien Fontanet 2022-06-07 13:34:34 +02:00 committed by GitHub
parent 3d43550ffe
commit dd5e11e835
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 0 deletions

View File

@ -7,6 +7,8 @@
> Users must be able to say: “Nice enhancement, I'm eager to test it”
- Show raw errors to administrators instead of _unknown error from the peer_ (PR [#6260](https://github.com/vatesfr/xen-orchestra/pull/6260))
### Bug fixes
> Users must be able to say: “I had this issue, happy to know it's fixed”

View File

@ -383,6 +383,11 @@ export default class Api {
})
}
// don't return *unknown error from the peer* if the user is admin
if (error.toJsonRpcError === undefined && context?.user.permission === 'admin') {
throw new JsonRpcError(error.message, undefined, serializeError(serializedError))
}
throw error
}
}