Update list of filtered parameters

config/initializers/filter_parameter_logging.rb

@@ -4,5 +4,5 @@
 # Use this to limit dissemination of sensitive information.
 # See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
 Rails.application.config.filter_parameters += [
-  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
+  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :authoriz
 ]

lib/seek/config.rb

@@ -110,7 +110,7 @@ def configure_recaptcha_keys
     end
 
     def configure_exception_notification
-      if exception_notification_enabled && Rails.env.production?
+      if exception_notification_enabled
         ExceptionNotification.configure do |config|
           config.ignored_exceptions = ['ActionDispatch::Http::Parameters::ParseError',
                                       'ActionController::InvalidAuthenticityToken',

lib/seek/errors/controller_error_handling.rb

@@ -13,12 +13,11 @@ module ControllerErrorHandling
       }.freeze
 
       def self.included(base)
-        unless Rails.application.config.consider_all_requests_local
-          base.rescue_from Exception, with: :render_application_error
-        end
+        base.rescue_from Exception, with: :render_application_error
       end
 
       def render_application_error(exception)
+        raise exception if Rails.application.config.consider_all_requests_local
         logger.error "ERROR - #{exception.class.name} (#{exception.message})"
         status = error_response_code(exception)
         exception_notification(status, exception)

lib/seek/errors/exception_forwarder.rb

@@ -7,15 +7,15 @@ class ExceptionForwarder
       # the option :data will get merged with some default info that reports the configured site host, and current user
       # information
       def self.send_notification(exception, options = {}, user = User.current_user)
-        Rails.logger.error "Sending execption ERROR - #{exception.class.name} (#{exception.message})"
+        Rails.logger.error "Sending exception ERROR - #{exception.class.name} (#{exception.message})"
         return unless Seek::Config.exception_notification_enabled
         env = options[:env]
         data = default_data(user).merge(options[:data] || {})
         begin
           ExceptionNotifier.notify_exception(exception, env: env, data: data)
-         rescue StandardError => deliver_exception
-           Rails.logger.error 'Error delivering exception email - ' \
-                        "#{deliver_exception.class.name} (#{deliver_exception.message})"
+        rescue StandardError => deliver_exception
+          Rails.logger.error 'Error delivering exception email - ' \
+                               "#{deliver_exception.class.name} (#{deliver_exception.message})"
         end
       end
 

test/integration/exception_notification_test.rb

@@ -0,0 +1,38 @@
+require 'test_helper'
+require 'minitest/mock'
+
+class ExceptionNotificationTest < ActionDispatch::IntegrationTest
+  test 'filters sensitive parameters out of exception notifications' do
+    with_config_values(email_enabled: true,
+                       exception_notification_enabled: true,
+                       exception_notification_recipients: 'no-reply@sysmo-db.org') do
+      emails = capture_emails do
+        User.stub(:admin_logged_in?, true) do
+          Rails.application.config.stub(:consider_all_requests_local, false) do
+            get fail_path, params: { http_code: '500',
+                                     password: 'unique_string_2',
+                                     email: 'unique_string_3',
+                                     unfiltered_param: 'unique_string_4',
+                                     author: 'unique_string_5'
+            }, as: :json, headers: {
+              'Accept' => 'application/vnd.api+json',
+              'Authorization' => 'Token unique_string_1'
+            }
+          end
+        end
+      end
+
+      assert_equal 1, emails.length
+      email = emails.last
+      body = email.body.to_s
+
+      assert_includes body, 'A NoMethodError occurred in fail'
+      assert_not_includes body, 'unique_string_1'
+      assert_not_includes body, 'unique_string_2'
+      assert_not_includes body, 'unique_string_3'
+      assert_includes body, 'unique_string_4'
+      assert_includes body, 'unique_string_5'
+      assert_match /HTTP_AUTHORIZATION\s+: \[FILTERED\]/, body
+    end
+  end
+end