Bug 39680 - Error handling in self service
Error handling in self service
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Self Service
UCS 4.1
Other Linux
: P5 normal (vote)
: UCS 4.1
Assigned To: Florian Best
Daniel Tröder
: interim-2
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-10-30 12:28 CET by Florian Best
Modified: 2015-11-17 12:11 CET (History)
1 user (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Error handling
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2015-10-30 12:28:13 CET
There is currently no error handling in the self service cherrypy backend which causes that exceptions end up in a simple HTML page displaying "500 internal server error". The frontend expects JSON and can't handle the error then.
Comment 1 Florian Best univentionstaff 2015-11-02 18:19:02 CET
svn r65092
Comment 2 Daniel Tröder univentionstaff 2015-11-04 16:04:29 CET
HTTP400
-------
# curl -s http://10.200.3.26/univention-self-service/passwordreset/foobar | json_xs 
{
   "message" : "The path '/univention-self-service/passwordreset/foobar' was not found."
}

# curl -v http://10.200.3.26/univention-self-service/passwordreset/foobar | json_xs -t none && echo "is JSON"
* Hostname was NOT found in DNS cache
*   Trying 10.200.3.26...
* Connected to 10.200.3.26 (10.200.3.26) port 80 (#0)
> GET /univention-self-service/passwordreset/foobar HTTP/1.1
> User-Agent: curl/7.38.0
> Host: 10.200.3.26
> Accept: */*
> 
< HTTP/1.1 404 Not Found
< Date: Wed, 04 Nov 2015 14:40:42 GMT
* Server Apache/2.2.22 (Univention) is not blacklisted
< Server: Apache/2.2.22 (Univention)
< Content-Length: 513
< Content-Type: application/json
< 
{ [data not shown]
* Connection #0 to host 10.200.3.26 left intact
is JSON

HTTP500
-------

# chown root:root /etc/self-service-ldap.secret
# curl -v -H "Content-Type: application/json" -X POST -d '{"username":"xyz"}' http://10.200.3.26/univention-self-service/passwordreset/get_reset_methods | json_xs -t none && echo "is JSON"
* Hostname was NOT found in DNS cache
*   Trying 10.200.3.26...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to 10.200.3.26 (10.200.3.26) port 80 (#0)
> POST /univention-self-service/passwordreset/get_reset_methods HTTP/1.1
> User-Agent: curl/7.38.0
> Host: 10.200.3.26
> Accept: */*
> Content-Type: application/json
> Content-Length: 18
> 
} [data not shown]
* upload completely sent off: 18 out of 18 bytes
< HTTP/1.1 500 Internal Server Error
< Date: Wed, 04 Nov 2015 15:00:05 GMT
* Server Apache/2.2.22 (Univention) is not blacklisted
< Server: Apache/2.2.22 (Univention)
< Content-Length: 513
< Connection: close
< Content-Type: application/json
< 
{ [data not shown]
100   531  100   513  100    18   2197     77 --:--:-- --:--:-- --:--:--  2201
* Closing connection 0
is JSON

# chown self-service:self-service /etc/self-service-ldap.secret

OK: error → correct HTTP-status + JSON

Note: Response is padded to 512 byte with spaces.
Comment 3 Florian Best univentionstaff 2015-11-04 16:09:46 CET
(In reply to Daniel Tröder from comment #2)
> Note: Response is padded to 512 byte with spaces.
That's a workaround from cherrypy for IE6 which only displays error content with at least 512 bytes. It probably doesn't cause errors as the json implementation can handle such things.

>>> json.loads('{}     ')
{}
Comment 4 Stefan Gohmann univentionstaff 2015-11-17 12:11:59 CET
UCS 4.1 has been released:
 https://docs.software-univention.de/release-notes-4.1-0-en.html
 https://docs.software-univention.de/release-notes-4.1-0-de.html

If this error occurs again, please use "Clone This Bug".