codeconsole commented on PR #16183: URL: https://github.com/apache/grails-core/pull/16183#issuecomment-5469507646
Accurate description of the behaviour, and fixed in 4a4b6f3 — your structure, with one addition. The mode now comes from `HiddenHttpMethod.isServletFilterMode` (either property), used by the dispatcher, handler mapping, URL mapping evaluator and `g:form` alike so they cannot drift. That is only sound if a filter really exists whenever either property is set, and it did not: Boot's filter comes from `WebMvcAutoConfiguration`, which backs off entirely under `@EnableWebMvc`. Asking for Boot's filter there produced **no** filter, while the Grails one had already backed off on the property. So the registration moved to its own auto-config ordered after Boot's, gating on `@ConditionalOnMissingBean` — detecting Boot's filter instead of assuming it — and contributing the Grails filter when Boot has not. Same pattern `GrailsFormContentFilterAutoConfiguration` already uses. Worth noting the case you found was worse than redundant: with `spring=true`, `g:form` stopped emitting `_method` for PUT and the POST member route appeared, so form updates hit the security chain as a POST — the exact silent authorization change the upgrade note warns about, landing on whoever opted in to avoid it. Covered by `GrailsHiddenHttpMethodFilterAutoConfigurationSpec`, including the `@EnableWebMvc` case. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
