snoopdave opened a new pull request, #171:
URL: https://github.com/apache/roller/pull/171
The XML-RPC servlet is configured to accept the library's non-standard vendor
extension types, which Roller does not use, and its mapped endpoint answers
requests even when the XML-RPC feature is switched off. This change turns the
extensions off and makes the disabled-by-default toggle close the endpoint.
## What changed
- Disable vendor extension types (`enabledForExtensions=false`, or drop the
enabling servlet init-param), since Roller uses only the standard XML-RPC
value types.
- Gate the mapped endpoint on `webservices.enableXmlRpc`, so a disabled API
is
closed at the endpoint instead of relying on per-handler checks.
- Preserve ordinary XML-RPC values and calls when the feature is enabled.
## Tests
- With the toggle off, both ordinary and extension-type requests are
rejected at
the endpoint.
- With the toggle on, an extension-type value is rejected while an ordinary
XML-RPC call reaches its handler.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
