snoopdave commented on PR #227: URL: https://github.com/apache/roller/pull/227#issuecomment-6508685889
GET should be safe, so I'd rather not accept a salt on GET. Can we make these actions POST-only instead? - Put `@HttpPost` on the methods that change data: `Pings.enable`/`disable`/`pingNow`, `PingTargets.enable`/`disable`, `MainMenu.accept`/`decline`, `Install.bootstrap` and `PingTargetEdit.save`. Add the `httpMethod` interceptor to `rollerStack`. This also replaces the `ServletRequestAware` check in `PingTargetEdit`. - Change those links to one-button POST forms with `<s:hidden name="salt"/>`. `ValidateSaltFilter` already checks the salt on every POST. - Remove the GET branch and `DISPLAY_METHODS` from `ValidateSaltInterceptor`. A list based on method names will drift. It already lists `activate`, which enables an account. That one is fine only because the activation code works as a secret, so make it an explicit exception. - Keep the redirect-after-POST with `store`. This keeps the salt out of URLs, logs and `Referer`, and link prefetchers can't trigger changes. Please also check that `@HttpPost` works with our `!method` URLs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
