Fix information leakage in API error responses

Co-authored-by: alvin000009238 <107313913+alvin000009238@users.noreply.github.com>

Author: google-labs-jules[bot]

app/routes/grades.py

@@ -36,7 +36,7 @@ def fetch_grades_route():
         return jsonify({'success': True, 'message': '成績已更新', 'data': data})
     except Exception as exc:
         logger.error(f'Error fetching grades (API): {exc}', exc_info=True)
-        return jsonify({'success': False, 'error': str(exc)}), 500
+        return jsonify({'success': False, 'error': '伺服器內部錯誤'}), 500
 
 
 @bp.route('/api/structure', methods=['GET'])
@@ -64,7 +64,7 @@ def get_structure_route():
         return jsonify({'structure': structure})
     except Exception as exc:
         logger.error(f'Error getting structure (API): {exc}', exc_info=True)
-        return jsonify({'error': str(exc)}), 500
+        return jsonify({'error': '伺服器內部錯誤'}), 500
 
 
 

app/routes/share.py

@@ -82,7 +82,7 @@ def create_share_link():
         return jsonify({'success': True, 'id': share_id})
     except Exception as exc:
         logger.error(f'Error creating share: {exc}', exc_info = True)
-        return jsonify({'error': str(exc)}), 500
+        return jsonify({'error': '伺服器內部錯誤'}), 500
 
 
 @bp.route('/api/share/<share_id>', methods=['PUT'])
@@ -147,7 +147,7 @@ def update_share_link(share_id):
         return jsonify({'success': True, 'id': share_id})
     except Exception as exc:
         logger.error(f'Error updating share: {exc}', exc_info=True)
-        return jsonify({'error': str(exc)}), 500
+        return jsonify({'error': '伺服器內部錯誤'}), 500
 
 
 @bp.route('/api/share/<share_id>', methods=['GET'])
@@ -167,7 +167,7 @@ def get_shared_grades(share_id):
         return jsonify({'success': True, 'data': data})
     except Exception as exc:
         logger.error(f'Error reading share: {exc}', exc_info = True)
-        return jsonify({'error': str(exc)}), 500
+        return jsonify({'error': '伺服器內部錯誤'}), 500
 
 
 @bp.route('/share/<share_id>')

app/routes/system.py

@@ -50,11 +50,11 @@ def health_check():
             redis_client.ping()
             redis_status = 'connected'
         except Exception as e:
-            logger.error(f'Health check: Redis ping failed: {e}')
+            logger.error(f'Health check: Redis ping failed: {e}', exc_info=True)
             return jsonify({
                 'status': 'error',
                 'redis': 'disconnected',
-                'detail': str(e),
+                'detail': '伺服器內部錯誤',
             }), 503
 
     return jsonify({'status': 'ok', 'redis': redis_status}), 200