Describe the bug
apiError.namedProperty(err, knownNames) reads err.errorMessage with no HTTP-status gate - unlike its sibling refusalMessageFor (#7073), which is gated to 400/409. Since spring.web.error.include-message=always, a 500 carries the raw exception text in message, and a Hibernate/JDBC failure that quotes a column name doubling as a form field (could not execute statement ... 'Name') is surfaced verbatim in the form banner and marks that field - the developer-facing leak the module's own header comment forbids.
Expected
namedProperty (or its caller applyApiError) applies only to 400/409, like refusalMessageFor; anything else falls back to the catalog message.
Context
#7066 (issue #7062). application-core/.../shell/js/services/apiError.js (namedProperty ~107), components/pages/baseFormPage.js (applyApiError ~63).
Describe the bug
apiError.namedProperty(err, knownNames)readserr.errorMessagewith no HTTP-status gate - unlike its siblingrefusalMessageFor(#7073), which is gated to 400/409. Sincespring.web.error.include-message=always, a 500 carries the raw exception text inmessage, and a Hibernate/JDBC failure that quotes a column name doubling as a form field (could not execute statement ... 'Name') is surfaced verbatim in the form banner and marks that field - the developer-facing leak the module's own header comment forbids.Expected
namedProperty(or its callerapplyApiError) applies only to 400/409, likerefusalMessageFor; anything else falls back to the catalog message.Context
#7066 (issue #7062).
application-core/.../shell/js/services/apiError.js(namedProperty~107),components/pages/baseFormPage.js(applyApiError~63).