mraible commented on code in PR #248:
URL: https://github.com/apache/roller/pull/248#discussion_r4571272941
##########
app/src/main/java/org/apache/roller/weblogger/ui/core/filters/LoadSaltFilter.java:
##########
@@ -32,11 +32,17 @@
*/
public class LoadSaltFilter implements Filter {
+ static final String RENDERING_PATH = "/roller-ui/rendering/";
+
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain)
throws IOException, ServletException {
HttpServletRequest httpReq = (HttpServletRequest) request;
+ if (isRenderingRequest(httpReq)) {
Review Comment:
I ran both cases against `mvn jetty:run` on master and on this branch. Both
comments are accepted in both builds, so nothing changes for commenters and
case 2 is not an existing bug.
The comment POST never reaches `ValidateSaltFilter`. The form posts to the
entry permalink (`/<weblog>/entry/<anchor>`), which is outside `/roller-ui/*`,
and `RequestMappingFilter` forwards it to `/roller-ui/rendering/comment/*`. The
`ValidateSaltFilter` mapping has no `<dispatcher>`, so it only runs on direct
requests and does not see the forward. `LoadSaltFilter` is mapped for `FORWARD`
as well, which is why it was creating sessions for page views.
A commenter also has a session either way: the entry page loads
`/CommentAuthenticatorServlet`, and the default math authenticator keeps its
answer in the session. On master the session came from the page view; with this
PR it comes from the authenticator.
The path you traced does exist for a direct POST to
`/roller-ui/rendering/comment/...` with a session, which returns 500 "Security
Violation" in both builds, but no form posts there.
I added coverage. `NewUserJourneyIT` now posts a comment through the real
form as the signed-in author and as a cookie-less visitor, and checks that
reading the weblog leaves the visitor without a `JSESSIONID`; that last check
fails on master. `SaltConfigurationTest` asserts the `ValidateSaltFilter`
mapping stays off `FORWARD`, since adding it would reject every comment.
`LoadSaltFilterTest` covers the forwarded comment POST. I also corrected the
comment in `LoadSaltFilter`, which claimed the rendering servlets contain no
forms.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
