This is an automated email from the ASF dual-hosted git repository. ChristopherSchultz pushed a commit to branch use-posts-for-writes in repository https://gitbox.apache.org/repos/asf/tomcat-connectors.git
commit 7e0b45288ee6eb8ca5bcfb3a6e27bcbd6fb1956b Author: ChristopherSchultz <[email protected]> AuthorDate: Wed Oct 21 11:25:02 2026 +0000 Require that modification requests use POST instead of GET --- native/common/jk_status.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/native/common/jk_status.c b/native/common/jk_status.c index c2ae615e6..65aa54552 100644 --- a/native/common/jk_status.c +++ b/native/common/jk_status.c @@ -5203,6 +5203,25 @@ static int JK_METHOD service(jk_endpoint_t *e, } } + if (!err) { + /* Ensure that all modifications are called as a POST */ + if((JK_STATUS_CMD_UPDATE == cmd + || JK_STATUS_CMD_RESET == cmd + || JK_STATUS_CMD_RECOVER == cmd) + && strcmp("POST", s->method)) { + jk_log(l, JK_LOG_WARNING, + "Status worker '%s' command '%s' denied for HTTP method '%s' (not POST) for user '%s' [%s] from %s [%s]", + w->name, + status_cmd_text(cmd), + s->method, + s->remote_user ? s->remote_user : "(null)", + s->auth_type ? s->auth_type : "(null)", + s->remote_addr ? s->remote_addr : "(null)", + s->remote_host ? s->remote_host : "(null)"); + err = "Method not allowed."; + } + } + if (!err) { char buf_time[JK_STATUS_TIME_BUF_SZ]; char buf_tz[JK_STATUS_TIME_BUF_SZ]; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
