Redmine DMSF

When executing https://domain.tld/preview/text?text=%0A%0A%0A{{dmsf(%27)}}& the system leaks information about database requests:

Fehler bei der Ausführung des Makros dmsf (Couldn't find DmsfFile with 'id'=' [WHERE `dmsf_files`.`deleted` = ?])

When executing https://domain.tld/preview/text?text=%0A%0A%0A{{dmsff(%27)}}& the system leaks even more information about database requests:

Fehler bei der Ausführung des Makros dmsff (Couldn't find DmsfFolder with 'id'=1000 [WHERE `dmsf_folders`.`deleted` = ? AND (projects.status <> 9 AND projects.status <> 10 AND EXISTS (SELECT 1 AS one FROM enabled_modules em WHERE em.project_id = projects.id AND em.name='dmsf'))])

You could hide this information by raising not ActiveRecord::RecordNotFound with its detailed information attached but raising a String like l(:notice_record_not_found) or something more specific to the underlying object.

This vulnerability has no probability to be used and no estimated risk according to our pentest report.