Repository: fossasia/open-event-server

Issue:
Do not show the query in error messages on production instances
An example error output:
```
{
    "errors": [
        {
            "source": "",
            "title": "Unknown error",
            "status": 500,
            "detail": "(psycopg2.DataError) invalid input syntax for type timestamp with time zone: \"2017-07fff-01T17:32:42.740Z\"\nLINE 4: ...events.deleted_at IS NULL AND events.starts_at >= '2017-07ff...\n                                                             ^\n [SQL: 'SELECT count(*) AS count_1 \\nFROM (SELECT events.id AS events_id, events.identifier AS events_identifier, events.name AS events_name, events.event_url AS events_event_url, events.logo_url AS events_logo_url, events.starts_at AS events_starts_at, events.ends_at AS events_ends_at, events.timezone AS events_timezone, events.latitude AS events_latitude, events.longitude AS events_longitude, events.location_name AS events_location_name, events.searchable_location_name AS events_searchable_location_name, events.description AS events_description, events.original_image_url AS events_original_image_url, events.thumbnail_image_url AS events_thumbnail_image_url, events.large_image_url AS events_large_image_url, events.icon_image_url AS events_icon_image_url, events.organizer_name AS events_organizer_name, events.is_map_shown AS events_is_map_shown, events.organizer_description AS events_organizer_description, events.is_sessions_speakers_enabled AS events_is_sessions_speakers_enabled, events.privacy AS events_privacy, events.state AS events_state, events.event_type_id AS events_event_type_id, events.event_topic_id AS events_event_topic_id, events.event_sub_topic_id AS events_event_sub_topic_id, events.ticket_url AS events_ticket_url, events.code_of_conduct AS events_code_of_conduct, events.schedule_published_on AS events_schedule_published_on, events.is_ticketing_enabled AS events_is_ticketing_enabled, events.deleted_at AS events_deleted_at, events.payment_country AS events_payment_country, events.payment_currency AS events_payment_currency, events.paypal_email AS events_paypal_email, events.is_tax_enabled AS events_is_tax_enabled, events.can_pay_by_paypal AS events_can_pay_by_paypal, events.can_pay_by_stripe AS events_can_pay_by_stripe, events.can_pay_by_cheque AS events_can_pay_by_cheque, events.can_pay_by_bank AS events_can_pay_by_bank, events.can_pay_onsite AS events_can_pay_onsite, events.cheque_details AS events_cheque_details, events.bank_details AS events_bank_details, events.onsite_details AS events_onsite_details, events.created_at AS events_created_at, events.pentabarf_url AS events_pentabarf_url, events.ical_url AS events_ical_url, events.xcal_url AS events_xcal_url, events.is_sponsors_enabled AS events_is_sponsors_enabled \\nFROM events \\nWHERE events.deleted_at IS NULL AND events.starts_at >= %(starts_at_1)s) AS anon_1'] [parameters: {'starts_at_1': u'2017-07fff-01T17:32:42.740Z'}]"
        }
    ],
    "jsonapi": {
        "version": "1.0"
    }
}
```

This can provide a possible-intruder with valuable information about our code. For production instance, no error message is needed for `500` server errors. 



Discussion:
> For production instance

Only for production right, else the error should be there ?
Yep. Only for production. For development, these errors are useful. 

Resolving patch:
diff --git a/config.py b/config.py
--- a/config.py
+++ b/config.py
@@ -55,6 +55,7 @@ class Config(object):
     SERVE_STATIC = env.bool('SERVE_STATIC', default=False)
     DATABASE_QUERY_TIMEOUT = 0.1
     SOFT_DELETE = True
+    PROPOGATE_ERROR = False
 
     if not SQLALCHEMY_DATABASE_URI:
         print('`DATABASE_URL` either not exported or empty')
@@ -104,6 +105,7 @@ class DevelopmentConfig(Config):
     DEVELOPMENT = True
     DEBUG = True
     CACHING = True
+    PROPOGATE_ERROR = True
 
     # Test database performance
     SQLALCHEMY_RECORD_QUERIES = True
@@ -120,3 +122,4 @@ class TestingConfig(Config):
     DEBUG_TB_ENABLED = False
     BROKER_BACKEND = 'memory'
     SQLALCHEMY_DATABASE_URI = env('TEST_DATABASE_URL', default=None)
+    PROPOGATE_ERROR = True


Test patch: