Ho, it turns out that passing invalid values for fields also hits something
similar to this.

This new patch handles DB errors for values like 'type':'123123123123' and also
catches '@sort0=FRUTA'.

It's not finished. I'm creating new issues with a command-line client (will
start editing them soon) and more cases will probably be uncovered :)

Oh, well, I didn't want to patch roundup-src just yet but I don't like this one.
Patch catches KeyError, returns None and handles that downstream.

I looked at it again, and there seems to be no easy way to turn it off. There is
WEB_DEBUG, and it is off, but that won't help, since this specific traceback
does not come from cgitb.html (which would be redirected to email by this flag),
but through cgitb.pt_html, and there is apparently no support for redirecting
that to email.

Setting the priority to "bug" then. The complete source code, including the
complete configuration data, is available for inspection by anybody in
subversion; it's open source. Whether or not it's desirable to display this
information, I don't know. If there is a real bug somewhere, it is sure helpful
if the report can include the corresponding traceback.

I think that showing the internal variables and their values on one side, and
the full traceback with directory names and everything on the other, could be
used by bad people to attack the system (I don't know how, but I'm not a cracker).

Even if the information exposed is not so important, what's the harm of not
showing it? Returning a 505, or a "Query bad formed" message should be enough.
Maybe disabling the "debug mode" in the server will do it and minimize the effort.

Anyway, I just wanted to point the issue to you, because maybe it was not a
desired effect. If you consciously want to leave it like this, it's ok to me
(feel free to close the bug).

Thank you!!

> If you create a bad URL, a lot of internal information is exposed:

What specific, security-relevant internal information are you referring
to? I can't see any in the traceback you provided.

Regards,
Martin

If you create a bad URL, a lot of internal information is exposed:

Try with this one...

  http://bugs.python.org/issue?@sort0=FRUTA

...and you'll see something like what I've attached.

(I put it as "critical" because it's a security issue)

Regards,

.    Facundo