Better handling of errors not generated by an exception; add to release notes

diff --git a/tornado/web.py b/tornado/web.py
index 629d8a5fa23ba0543754715d962c3041d350742e..d436975491919b690c9159b8a013089ec5d61378 100644 (file)
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -657,7 +657,7 @@ class RequestHandler(object):
         If this error was caused by an uncaught exception, the
         exception object can be found in kwargs e.g. kwargs['exception']
         """
-        if self.settings.get("debug"):
+        if self.settings.get("debug") and "exception" in kwargs:
             # in debug mode, try to send a traceback
             self.set_header('Content-Type', 'text/plain')
             return traceback.format_exc()

diff --git a/website/sphinx/releases/next.rst b/website/sphinx/releases/next.rst
index 54ed8ede6298b983243ca2e6561d07ca0473924a..f9d56abaa0d5acaf268525eb8945a34ee705c5ee 100644 (file)
--- a/website/sphinx/releases/next.rst
+++ b/website/sphinx/releases/next.rst
@@ -10,6 +10,9 @@ Backwards-incompatible changes
 * Support for secure cookies written by pre-1.0 releases of Tornado has
   been removed.  The `RequestHandler.get_secure_cookie` method no longer
   takes an ``include_name`` parameter.
+* The ``debug`` application setting now causes stack traces to be displayed
+  in the browser on uncaught exceptions.  Since this may leak sensitive
+  information, debug mode is not recommended for public-facing servers.
 
 New features
 ~~~~~~~~~~~~