Dave, The multipart/form-data file upload does not pass the request parameters in the normal way, so when the ValidateSaltFilter tries to get the "salt" parameter it cannot find it.
To resolve this we will need to either exclude this action from the salt filter or wrap the http request, extending HttpServletRequestWrapper so we can get at the parameter values. One way this could be done is to access the parameters via org.apache.commons.fileupload.servlet.ServletFileUpload and its parse(request) method and then strip out the non form field items. Unless someone else knows of an easier way to get at the parameters? Cheers Greg.
