Restricting visibility of detailed_error message (#3629)

api/context.go

@@ -204,12 +204,18 @@ func (h handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		h.handleFunc(c, w, r)
 	}
 
+	// Handle errors that have occoured
 	if c.Err != nil {
 		c.Err.Translate(c.T)
 		c.Err.RequestId = c.RequestId
 		c.LogError(c.Err)
 		c.Err.Where = r.URL.Path
 
+		// Block out detailed error whenn not in developer mode
+		if !*utils.Cfg.ServiceSettings.EnableDeveloper {
+			c.Err.DetailedError = ""
+		}
+
 		if h.isApi {
 			w.WriteHeader(c.Err.StatusCode)
 			w.Write([]byte(c.Err.ToJson()))

mattermost.go

@@ -105,6 +105,11 @@ func main() {
 	l4g.Info(utils.T("mattermost.working_dir"), pwd)
 	l4g.Info(utils.T("mattermost.config_file"), utils.FindConfigFile(flagConfigFile))
 
+	// Enable developer settings if this is a "dev" build
+	if model.BuildNumber == "dev" {
+		*utils.Cfg.ServiceSettings.EnableDeveloper = true
+	}
+
 	// Special case for upgrading the db to 3.0
 	// ADDED for 3.0 REMOVE for 3.4
 	cmdUpdateDb30()