snoopdave commented on code in PR #227:
URL: https://github.com/apache/roller/pull/227#discussion_r4394674168
##########
app/src/main/java/org/apache/roller/weblogger/ui/struts2/util/ValidateSaltInterceptor.java:
##########
@@ -33,13 +35,23 @@
import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
/**
- * Validates salts after Struts has wrapped a multipart form request.
+ * Validates salts after Struts has wrapped a multipart form request, and on
+ * requests other than POST that call an action method which changes data.
*/
public class ValidateSaltInterceptor extends AbstractInterceptor implements
StrutsStatics {
private static final long serialVersionUID = 2446434402795510394L;
private static final Log log =
LogFactory.getLog(ValidateSaltInterceptor.class);
+ /**
+ * Action methods that only display data. Links and redirects may reach
+ * these without a salt; any other method needs a POST or a salt.
+ */
+ static final Set<String> DISPLAY_METHODS = Set.of(
Review Comment:
🤖Claude: fixed by adding the salt to the install!bootstrap URL in
CreateDatabase.jsp and UpgradeDatabase.jsp. Checked on a fresh Jetty install:
token, create tables, then the bootstrap link completes setup and lands on the
front page (6e13c0c9c).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
