Fix error message disclosure in API endpoints

Replace exception getMessage() exposure with generic error messages
to prevent internal information disclosure. Errors are now logged
with full details while clients receive sanitized responses.

Affected endpoints:
- add_comment, update_comment, delete_comment
- update_ticket, export_tickets
- generate_api_key, revoke_api_key
- manage_templates, manage_workflows, manage_recurring
- custom_fields, get_users

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

api/add_comment.php

@@ -116,11 +116,14 @@ try {
 } catch (Exception $e) {
     // Discard any unexpected output
     ob_end_clean();
-    
+
+    // Log error details but don't expose to client
+    error_log("Add comment API error: " . $e->getMessage());
+
     // Return error response
     header('Content-Type: application/json');
     echo json_encode([
         'success' => false,
-        'error' => $e->getMessage()
+        'error' => 'An internal error occurred'
     ]);
 }

api/custom_fields.php

@@ -97,6 +97,7 @@ try {
     }
 
 } catch (Exception $e) {
+    error_log("Custom fields API error: " . $e->getMessage());
     http_response_code(500);
-    echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+    echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
 }

api/delete_comment.php

@@ -89,9 +89,10 @@ try {
 
 } catch (Exception $e) {
     ob_end_clean();
+    error_log("Delete comment API error: " . $e->getMessage());
     header('Content-Type: application/json');
     echo json_encode([
         'success' => false,
-        'error' => $e->getMessage()
+        'error' => 'An internal error occurred'
     ]);
 }

api/export_tickets.php

@@ -157,10 +157,11 @@ try {
     }
 
 } catch (Exception $e) {
+    error_log("Export tickets API error: " . $e->getMessage());
     header('Content-Type: application/json');
     http_response_code(500);
     echo json_encode([
         'success' => false,
-        'error' => $e->getMessage()
+        'error' => 'An internal error occurred'
     ]);
 }

api/generate_api_key.php

@@ -108,10 +108,11 @@ try {
 
 } catch (Exception $e) {
     ob_end_clean();
+    error_log("Generate API key error: " . $e->getMessage());
     header('Content-Type: application/json');
     http_response_code(isset($conn) ? 400 : 500);
     echo json_encode([
         'success' => false,
-        'error' => $e->getMessage()
+        'error' => 'An internal error occurred'
     ]);
 }

api/get_users.php

@@ -42,6 +42,7 @@ try {
     echo json_encode(['success' => true, 'users' => $users]);
 
 } catch (Exception $e) {
+    error_log("Get users API error: " . $e->getMessage());
     http_response_code(500);
-    echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+    echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
 }

api/manage_recurring.php

@@ -124,8 +124,9 @@ try {
     }
 
 } catch (Exception $e) {
+    error_log("Recurring tickets API error: " . $e->getMessage());
     http_response_code(500);
-    echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+    echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
 }
 
 function calculateNextRun($scheduleType, $scheduleDay, $scheduleTime) {

api/manage_templates.php

@@ -89,7 +89,8 @@ try {
             if ($stmt->execute()) {
                 echo json_encode(['success' => true, 'template_id' => $conn->insert_id]);
             } else {
-                echo json_encode(['success' => false, 'error' => $stmt->error]);
+                error_log("Template creation failed: " . $stmt->error);
+                echo json_encode(['success' => false, 'error' => 'Failed to create template']);
             }
             $stmt->close();
             break;
@@ -139,6 +140,7 @@ try {
     }
 
 } catch (Exception $e) {
+    error_log("Template API error: " . $e->getMessage());
     http_response_code(500);
-    echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+    echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
 }

api/manage_workflows.php

@@ -103,7 +103,8 @@ try {
 
                 echo json_encode(['success' => true, 'transition_id' => $transitionId]);
             } else {
-                echo json_encode(['success' => false, 'error' => $stmt->error]);
+                error_log("Workflow creation failed: " . $stmt->error);
+                echo json_encode(['success' => false, 'error' => 'Failed to create workflow transition']);
             }
             $stmt->close();
             break;
@@ -180,6 +181,7 @@ try {
     }
 
 } catch (Exception $e) {
+    error_log("Workflow API error: " . $e->getMessage());
     http_response_code(500);
-    echo json_encode(['success' => false, 'error' => $e->getMessage()]);
+    echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
 }

api/revoke_api_key.php

@@ -101,10 +101,11 @@ try {
 
 } catch (Exception $e) {
     ob_end_clean();
+    error_log("Revoke API key error: " . $e->getMessage());
     header('Content-Type: application/json');
     http_response_code(isset($conn) ? 400 : 500);
     echo json_encode([
         'success' => false,
-        'error' => $e->getMessage()
+        'error' => 'An internal error occurred'
     ]);
 }

api/update_comment.php

@@ -86,9 +86,10 @@ try {
 
 } catch (Exception $e) {
     ob_end_clean();
+    error_log("Update comment API error: " . $e->getMessage());
     header('Content-Type: application/json');
     echo json_encode([
         'success' => false,
-        'error' => $e->getMessage()
+        'error' => 'An internal error occurred'
     ]);
 }

api/update_ticket.php

@@ -315,13 +315,16 @@ try {
 } catch (Exception $e) {
     // Discard any output that might have been generated
     ob_end_clean();
-    
+
+    // Log error details but don't expose to client
+    error_log("Update ticket API error: " . $e->getMessage());
+
     // Return error response
     header('Content-Type: application/json');
     http_response_code(500);
     echo json_encode([
         'success' => false,
-        'error' => $e->getMessage()
+        'error' => 'An internal error occurred'
     ]);
 }
 ?>