[
https://issues.apache.org/jira/browse/JSPWIKI-1323?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18139300#comment-18139300
]
ASF subversion and git services commented on JSPWIKI-1323:
----------------------------------------------------------
Commit 8375c0255069f60e33374e4d0ee22472b9198e9b in jspwiki's branch
refs/heads/master from Arturo Bernal
[ https://gitbox.apache.org/repos/asf?p=jspwiki.git;h=8375c0255 ]
JSPWIKI-1323 Add the entry of the change to the ChangeLog
> A malformed JSPWikiUserPrefs cookie makes the page lose its stylesheets and
> scripts
> -----------------------------------------------------------------------------------
>
> Key: JSPWIKI-1323
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1323
> Project: JSPWiki
> Issue Type: Bug
> Reporter: Arturo Bernal
> Priority: Minor
> Labels: pull-request-available
>
> The preferences of the user are read from the cookie JSPWikiUserPrefs in
> Preferences.parseJSONPreferences (jspwiki-main) with new Gson().fromJson(
> value, Map.class ) and no error handling.
> Measured on master (4b436f943, the war on Tomcat 10.1), requesting Wiki.jsp
> for the page Main with the cookie set:
> * No cookie, or a JSON object with an unknown SkinName, an invalid TimeZone
> or DateFormat, an unknown Language, or null or array values: HTTP 200 and the
> complete page (9966 bytes, 4 script tags, links to templates/default/).
> * A value that is not JSON ({not-json) or is not a JSON object ([1,2], 123,
> "text"): HTTP 200 but a page of 3954 bytes with the header, the content and
> the footer and nothing in the head: no link to the stylesheets and no script
> tag (0 of them). The log has com.google.gson.JsonSyntaxException inside a JSP
> tag (WikiTagBase).
> The user gets the page as plain HTML without style, and because no script is
> loaded, the script that would replace the cookie (Wiki.js compares the
> version stored in it) never runs, so the page stays that way until the cookie
> is deleted by hand. This is the kind of incompatibility between the server
> and the cookie that JSPWIKI-168 is about.
> I do not know how a real user ends up with such a cookie: I built these
> values by hand and did not try a cookie written by an older version.
> Proposal: ignore the cookie when its value is not a JSON object, so that the
> default preferences are used and the script can replace it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
