snoopdave opened a new pull request, #167:
URL: https://github.com/apache/roller/pull/167
Roller's UI CSRF protection uses two salt filters: one checks the token
submitted with a request, the other generates the token for the next
response.
This change gives each filter a single responsibility and corrects the order
in
which they run.
## What changed
- Validate and consume the `salt` value submitted with the request.
- Run validation before the response-salt filter; mint the fresh response
salt
only after a successful validation, and terminate rejected POSTs without a
replacement token.
- Defer multipart `*.rol` validation to an interceptor that runs immediately
after the upload interceptor, and reject non-Struts multipart requests that
lack a submitted token.
- Remove the `salt.ignored.urls` setting and its `isIgnoredURL()` helper,
which
did not match the shipped values correctly.
## Tests
- A request without a valid submitted `salt` is rejected; one valid token
succeeds once and a second use of the same token fails.
- Filter ordering validates before response-token generation.
- Successful POSTs that render forms receive a new response token.
- Multipart actions accept one valid token and reject missing, invalid, and
already-used tokens, exercised on the supported Tomcat deployment and the
repository Jetty test setup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
