Dogface2k opened a new pull request, #13768: URL: https://github.com/apache/cloudstack/pull/13768
### Description This PR fixes object storage creation from the UI by submitting `addObjectStoragePool` as a form-encoded POST request instead of a GET request. The object-storage form carries provider access and secret keys in indexed `details` parameters. Sending those parameters with GET both fails when POST enforcement is enabled and places credentials in the request URL. The UI now uses the existing `postAPI` transport, preserving the command and parameter names while moving them into the request body. The server-side request classification is hardened at the same boundary: - `addObjectStoragePool` is marked as containing sensitive request information; - debug logging suppresses POST parameters for this command, matching the existing handling for credential-bearing infrastructure commands; - the existing logging decision was extracted without changing its behavior for ordinary commands or requests containing user data. No object-store discovery, provider, persistence, response, or authorization behavior is changed. Fixes: #13679 ### Types of changes - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] New feature (non-breaking change which adds functionality) - [x] Bug fix (non-breaking change which fixes an issue) - [ ] Enhancement (improves an existing feature and functionality) - [ ] Cleanup (Code refactoring and cleanup, that may add test cases) - [ ] Build/CI - [ ] Test (unit or integration test code) ### Feature/Enhancement Scale or Bug Severity #### Feature/Enhancement Scale - [ ] Major - [ ] Minor #### Bug Severity - [ ] BLOCKER - [ ] Critical - [x] Major - [ ] Minor - [ ] Trivial ### Screenshots (if appropriate): Not applicable. ### How Has This Been Tested? Regression coverage was added for both request transport and credential handling: - the UI test verifies a single POST to `/`, no query-parameter payload, and preservation of the indexed access-key and secret-key fields in the form body; - the UI test verifies API failures remain propagated to the existing error path; - the servlet tests verify object-storage POST fields are not logged while ordinary POST logging and the existing user-data suppression behavior remain unchanged; - the API command test verifies the request is classified as containing sensitive information. The complete patch passes `git diff --check` and source-contract checks. The branch is initially opened as a draft so the repository's Java 17 and Node 16 workflows can provide the authoritative build, lint, and test results before it is marked ready. ### How did you try to break this feature and the system with this change? The transport test includes both credential fields using their real indexed parameter names and explicitly asserts that Axios receives no `params` object, preventing an accidental fallback to the URL query string. A rejected API request is also exercised to ensure the component does not swallow backend errors. Server-side negative controls cover a non-sensitive command and a user-data request, proving the logging change does not disable parameter logging globally or bypass the existing sensitive user-data rule. The production logging predicate remains logically identical for every existing command; only `addObjectStoragePool` is added to the established no-parameter-logging set. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
