snoopdave commented on code in PR #227:
URL: https://github.com/apache/roller/pull/227#discussion_r4394336496
##########
app/src/main/java/org/apache/roller/weblogger/ui/struts2/util/ValidateSaltInterceptor.java:
##########
@@ -33,13 +35,23 @@
import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
/**
- * Validates salts after Struts has wrapped a multipart form request.
+ * Validates salts after Struts has wrapped a multipart form request, and on
+ * requests other than POST that call an action method which changes data.
*/
public class ValidateSaltInterceptor extends AbstractInterceptor implements
StrutsStatics {
private static final long serialVersionUID = 2446434402795510394L;
private static final Log log =
LogFactory.getLog(ValidateSaltInterceptor.class);
+ /**
+ * Action methods that only display data. Links and redirects may reach
+ * these without a salt; any other method needs a POST or a salt.
+ */
+ static final Set<String> DISPLAY_METHODS = Set.of(
Review Comment:
**Important:** The fresh-install click-through breaks with this change:
`CreateDatabase.jsp:36` and `UpgradeDatabase.jsp:54` render
`installer.tryBootstrapping` as a plain GET link (`<a href="{0}">` around
`<s:url action="install!bootstrap"/>`), `bootstrap` is not in
`DISPLAY_METHODS`, and the link carries no salt — so completing a fresh
installation by clicking that link now throws. Same class of miss as the
menu/pings links this PR fixes. Either add `salt` params to those two `s:url`s
(the pages render a salt) or route the installer flow through POST.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
