erp5_api_style: FIXUP rewrite

bt5/erp5_api_style/DocumentTemplateItem/portal_components/document.erp5.jIOWebSection.py

@@ -38,25 +38,25 @@ from erp5.component.document.WebSection import WebSection
 MARKER = []
 ALLOWED_MODES = ["put", "get", "post", "allDocs"]
 
-class jIOTraverseErrorWrapper(object):
+class jIOAPITraverseErrorWrapper(object):
   """
   JSON error object, to avoid ERP5 default error pages.
   Publishable but non-Persistent and without Acquisition.
   """
 
-  def __init__(self, context, portal):
-    self.context = context
+  def __init__(self, error_context, portal):
+    self.error_context = error_context
     self.portal = portal
 
   # Used for debugging, especially in tests
   def __str__(self):
-    return str(self.context)
+    return str(self.error_context)
 
   def __call__(self):
     portal = self.portal
 
     # Skin used to allow replacement and because Manager proxy role is needed
-    portal.ERP5Site_logApiErrorAndReturn(**self.context)
+    portal.ERP5Site_logApiErrorAndReturn(**self.error_context)
 
 
 class jIOMethod(object):
@@ -77,23 +77,25 @@ class jIOMethod(object):
     try:
       return self.web_section.ERP5Site_asjIOStyle(
         mode=self.mode_name,
-        text_content=self.web_section.REQUEST.get('BODY'),
+        text_content=self.web_section.REQUEST.get("BODY"),
         data_dict=None,
       )
     except Exception as e:
       error_context = {
         "error_code": 500,
-        "error_name": "API-INTERNAL-ERROR"
+        "error_name": "API-INTERNAL-ERROR",
+        "error_message": str(e)
       }
 
       # This NotFound catches instance of objects not found inside API call
       if isinstance(e, NotFound):
         error_context["error_code"] = 404
         error_context["error_name"] = "API-NOT-FOUND"
-        error_context["error_message"] = str(e)
       elif isinstance(e, Unauthorized):
         error_context["error_code"] = 403
         error_context["error_name"] = "API-UNAUTHORIZED"
+        # Avoid information leak when Unauthorized
+        del error_context["error_message"]
 
       # Skin used to allow replacement and because Manager proxy role is needed
       self.web_section.ERP5Site_logApiErrorAndReturn(**error_context)
@@ -112,15 +114,14 @@ class jIOWebSection(WebSection):
     acquiring it from the current section or its parents.
     """
     section = aq_inner(self)
-    while section.getPortalType() in ('Web Section', 'Web Site', 'Static Web Section', 'Static Web Site',
-                                      'jIO Web Section'):
+    while section.getPortalType() in ("Web Section", "Web Site", "Static Web Section", "Static Web Site", "jIO Web Section"):
       result = section.getProperty(key, MARKER)
       if result not in (MARKER, None):
         return result
       section = section.aq_parent
     return default
 
-  security.declareProtected(Permissions.View, '__bobo_traverse__')
+  security.declareProtected(Permissions.View, "_bobo_traverse__")
   def __bobo_traverse__(self, request, name):
     if name in ALLOWED_MODES:
       return jIOMethod(name, self)
@@ -138,6 +139,6 @@ class jIOWebSection(WebSection):
         "error_name": "NotFound",
         "text_content": request.get("BODY")
       }
-      document = jIOTraverseErrorWrapper(error_context, self.getPortalObject())
+      document = jIOAPITraverseErrorWrapper(error_context, self.getPortalObject())
 
     return document