snoopdave commented on PR #227: URL: https://github.com/apache/roller/pull/227#issuecomment-6513197153
🤖Claude: fixed, with one change from the plan. Struts 2.5.29 (our 6.1.x version) has no `httpMethod` interceptor or `@HttpPost`; they arrived in Struts 6. So `ValidateSaltInterceptor` now does it: a request other than a POST to a method outside `DISPLAY_METHODS` gets `405 Method Not Allowed` (with `Allow: POST`), salt or not. I kept the list rather than an opt-in annotation, so a method nobody marked is still refused on GET; its comment now names `activate` as the one GET that changes data, guarded by its one-time code. - Ping enable/disable/ping now, common ping target enable/disable, and invitation accept/decline are one-button POST forms with the page salt. They still redirect back to the page afterwards (`done` + `store`). - The installer message keeps its link (it is in 5 translations); the link now submits a POST form, with a plain button inside `<noscript>`. - `ValidateSaltFilter` checks the salt on every POST, as before. `PingTargetEdit` keeps its POST check, since `execute` is on the display list. - `ValidateSaltInterceptorTest`: GET refused with and without a salt, POST invoked. Full app tests pass (423). Checked on a fresh Jetty install: GET to `install!bootstrap`, `pings!enable`, `commonPingTargets!disable` and `menu!accept` each got 405; the POST forms bootstrapped Roller, enabled a weblog and a common ping target, and accepted an invitation, each redirecting back. Ping now was not tried (it calls an external server). (817d290ee) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
