CKAN may leak Solr credentials via error message in package_search action

@@ -1,6 +1,6 @@
 # encoding: utf-8
 
-__version__ = "2.10.5b"
+__version__ = "2.10.5"
 
 # The packaging system relies on this import, please do not remove it
 # type_ignore_reason: pyright thinks it's iterable

@@ -29,6 +29,10 @@ class SearchQueryError(SearchError):
     pass
 
 
+class SolrConnectionError(Exception):
+    pass
+
+
 DEFAULT_SOLR_URL = 'http://127.0.0.1:8983/solr/ckan'
 
 

@@ -22,6 +22,7 @@
 
 from ckan.lib.search.common import (
     make_connection, SearchIndexError, SearchQueryError,  # type: ignore
+    SolrConnectionError, # type: ignore
     SearchError, is_available, SolrSettings, config
 )
 from ckan.lib.search.index import (

@@ -18,7 +18,7 @@
 
 from ckan.common import config
 from ckan.lib.search.common import (
-    make_connection, SearchError, SearchQueryError
+    make_connection, SearchError, SearchQueryError, SolrConnectionError
 )
 from ckan.types import Context
 
@@ -473,6 +473,12 @@ def _check_query_parser(param: str, value: Any):
                         "Can't determine Sort Order" in e.args[0] or \
                         'Unknown sort order' in e.args[0]:
                     raise SearchQueryError('Invalid "sort" parameter')
+
+                if ("Failed to connect to server" in e.args[0] or 
+                        "Connection to server" in e.args[0]):
+                    log.warning("Connection Error: Failed to connect to Solr server.")
+                    raise SolrConnectionError("Solr returned an error while searching.")
+
             raise SearchError('SOLR returned an error running query: %r Error: %r' %
                               (query, e))
         self.count = solr_response.hits

@@ -416,3 +416,12 @@ def test_header_based_auth_default_post(app):
     res = app.post(url, environ_overrides=env, data=data)
 
     assert res.status_code == 200
+
+
+@pytest.mark.ckan_config("solr_url", "https://xxxx/notofund")
+def test_package_search_connection_errors(app):
+
+    res = app.get(
+        url_for("api.action", logic_function="package_search", ver=3),
+    )
+    assert res.json["error"]["__type"] == "Search Connection Error"

@@ -22,7 +22,9 @@
 
 from ckan.lib.navl.dictization_functions import DataError
 from ckan.logic import get_action, ValidationError, NotFound, NotAuthorized
-from ckan.lib.search import SearchError, SearchIndexError, SearchQueryError
+from ckan.lib.search import (
+    SearchError, SearchIndexError, SearchQueryError, SolrConnectionError
+)
 from ckan.types import Context, Response, ActionResult
 
 
@@ -333,6 +335,12 @@ def action(logic_function: str, ver: int = API_DEFAULT_VERSION) -> Response:
                        str(e)}
         return_dict[u'success'] = False
         return _finish(500, return_dict, content_type=u'json')
+    except SolrConnectionError:
+        return_dict[u'error'] = {
+            u'__type': u'Search Connection Error',
+            u'message': u'Unable to connect to the search server'}
+        return_dict[u'success'] = False
+        return _finish(500, return_dict, content_type=u'json')
     except Exception as e:
         return_dict[u'error'] = {
             u'__type': u'Internal Server Error',

@@ -26,7 +26,9 @@
 from ckan.common import _, config, g, request
 from ckan.views.home import CACHE_PARAMETERS
 from ckan.lib.plugins import lookup_package_plugin
-from ckan.lib.search import SearchError, SearchQueryError, SearchIndexError
+from ckan.lib.search import (
+    SearchError, SearchQueryError, SearchIndexError, SolrConnectionError
+)
 from ckan.types import Context, Response
 
 
@@ -348,7 +350,10 @@ def search(package_type: str) -> str:
             _(u'Invalid search query: {error_message}')
             .format(error_message=str(se))
         )
-    except SearchError as se:
+    except (SearchError, SolrConnectionError) as se:
+        if isinstance(se, SolrConnectionError):
+            base.abort(500, se.args[0])
+
         # May be bad input from the user, but may also be more serious like
         # bad code causing a SOLR syntax error, or a problem connecting to
         # SOLR