arturobernalg opened a new pull request, #562: URL: https://github.com/apache/jspwiki/pull/562
JSPWIKI-816: after a new user profile is saved from the login page, the user can end on a Forbidden error page instead of the wiki. Cause: in Login.jsp, after the profile is saved, the redirect parameter is used as it comes. When it is empty, the view URL that is built is Login.jsp again, and since the user is already authenticated, that page answers with the Forbidden error. The log has Illegal page name for an empty name. The login branch of the same file already goes to the front page when the page of the redirect parameter does not exist; the saved profile branch did not. Change: the saved profile branch does the same check as the login branch and goes to the front page when the page of the redirect parameter does not exist, which includes an empty value. Measured in the browser on a Tomcat 10.1 instance, registering a new profile from the login page with the hidden redirect field empty, which is the URL of the report: Before: the browser ended on Login.jsp?redirect= with the Forbidden page, and the log had Illegal page name. With the war built from this branch: the browser ends on the front page, no Forbidden page, and the log has no Illegal page name. Control, before the change: the same registration with the default redirect value (the front page) worked. Not done: there is no automated test, since Login.jsp has none in this repository. I set the redirect field by hand to be empty; I did not find out which links of the templates give an empty value in a real use, so that cause is not addressed. Only Chrome was tried and the mail of the registration failed in my test instance because it has no mail server, which does not change the redirect. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
