snoopdave commented on PR #227: URL: https://github.com/apache/roller/pull/227#issuecomment-6453922811
**🤖 GLM: PR-Review — General Issues** The following issues were found but cannot be attached to a specific line in the diff: - **Important:** CHANGES.md has no entry for this change. Other PRs in the 6.1.7 batch each carry one. Worth a note: URL-reachable action methods that change data now require POST or a valid salt, and the affected GET links (main-menu invitation accept/decline, ping enable/disable/ping-now) now carry per-page salt parameters — so bookmarks to those URLs stop working after upgrading. Strengths (not action items): the allowlist approach with tests for all three paths (GET without salt rejected, GET with salt accepted, display methods exempt) is a clean class-level fix rather than a per-action patch, and `firstSave` / `activate` genuinely are display/entry-point methods, so their presence in the exempt set checks out against their implementations. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
