Re: (ofbiz-framework) branch release24.09 updated: Improved: Check parameters passed in URLs (OFBIZ-13295)

[Nicolas Malin]

Nice :)

Thanks Jacques

On 13/10/2025 09:57, Jacques Le Roux wrote:

Hi Nicolas,

Oops no, missed that when handling conflicts by hand. I push it clean.

Thanks

Jacques

Le 13/10/2025 à 09:17, Nicolas Malin a écrit :

Hello Jacques

On 12/10/2025 08:22, jler...@apache.org wrote:

--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java

@@ -174,11 +174,10 @@ public class ControlFilter extends HttpFilter {
          String context = req.getContextPath();
          HttpSession session = req.getSession();
  -        // Prevents stream exploitation
-        if (!isSolrTest()) {
-            if (!isControlFilterTests()) {

-                UrlServletHelper.setRequestAttributes(req, null, req.getServletContext());

-            }
+        if (!(isSolrTest() || isControlFilterTests())) {
+            // Prevents stream exploitation

+            UrlServletHelper.setRequestAttributes(req, null, req.getServletContext()); +            UrlServletHelper.setRequestAttributes(req, null, req.getServletContext());

A reason to call twice the function `UrlServletHelper.setRequestAttributes(req, null, req.getServletContext())` ?

Nicolas