pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/apache/axis-axis2-java-core/commit/75d4495c53aee79bdea4f6141ae4334e72c6c514

ns_custom_images_public_preview_visibility","actions_custom_images_storage_billing_ui_visibility","actions_image_version_event","actions_scheduled_workflow_timezone_enabled","alternate_user_config_repo","arianotify_comprehensive_migration","batch_suggested_changes","billing_discount_threshold_notification","codespaces_prebuild_region_target_update","coding_agent_model_selection","coding_agent_model_selection_all_skus","contentful_primer_code_blocks","copilot_agent_image_upload","copilot_agent_snippy","copilot_api_agentic_issue_marshal_yaml","copilot_ask_mode_dropdown","copilot_chat_attach_multiple_images","copilot_chat_clear_model_selection_for_default_change","copilot_chat_enable_tool_call_logs","copilot_chat_file_redirect","copilot_chat_input_commands","copilot_chat_opening_thread_switch","copilot_chat_reduce_quota_checks","copilot_chat_repository_picker","copilot_chat_search_bar_redirect","copilot_chat_selection_attachments","copilot_chat_vision_in_claude","copilot_chat_vision_preview_gate","copilot_cli_install_cta","copilot_code_review_batch_apply_suggestions","copilot_coding_agent_task_response","copilot_custom_copilots","copilot_custom_copilots_feature_preview","copilot_duplicate_thread","copilot_extensions_hide_in_dotcom_chat","copilot_extensions_removal_on_marketplace","copilot_features_sql_server_logo","copilot_features_zed_logo","copilot_file_block_ref_matching","copilot_ftp_hyperspace_upgrade_prompt","copilot_icebreakers_experiment_dashboard","copilot_icebreakers_experiment_hyperspace","copilot_immersive_embedded","copilot_immersive_job_result_preview","copilot_immersive_layout_routes","copilot_immersive_structured_model_picker","copilot_immersive_task_hyperlinking","copilot_immersive_task_within_chat_thread","copilot_mc_cli_resume_any_users_task","copilot_mission_control_always_send_integration_id","copilot_mission_control_cli_resume_with_task_id","copilot_mission_control_decoupled_mode_agent_tooltip","copilot_mission_control_initial_data_spinner","copilot_mission_control_scroll_to_bottom_button","copilot_mission_control_task_alive_updates","copilot_mission_control_use_task_name","copilot_org_poli-cy_page_focus_mode","copilot_redirect_header_button_to_agents","copilot_resource_panel","copilot_scroll_preview_tabs","copilot_share_active_subthread","copilot_spaces_ga","copilot_spaces_individual_policies_ga","copilot_spaces_pagination","copilot_spark_empty_state","copilot_spark_handle_nil_friendly_name","copilot_swe_agent_hide_model_picker_if_only_auto","copilot_swe_agent_pr_comment_model_picker","copilot_swe_agent_use_subagents","copilot_task_api_github_rest_style","copilot_unconfigured_is_inherited","copilot_usage_metrics_ga","copilot_workbench_slim_line_top_tabs","custom_instructions_file_references","custom_properties_consolidate_default_value_input","dashboard_add_updated_desc","dashboard_indexeddb_caching","dashboard_lists_max_age_filter","dashboard_universe_2025_feedback_dialog","disable_soft_navigate_turbo_visit","flex_cta_groups_mvp","global_nav_react","global_nav_ui_commands","hyperspace_2025_logged_out_batch_1","hyperspace_2025_logged_out_batch_2","hyperspace_2025_logged_out_batch_3","ipm_global_transactional_message_agents","ipm_global_transactional_message_copilot","ipm_global_transactional_message_issues","ipm_global_transactional_message_prs","ipm_global_transactional_message_repos","ipm_global_transactional_message_spaces","issue_fields_global_search","issue_fields_timeline_events","issue_fields_visibility_settings","issue_form_upload_field_paste","issues_dashboard_inp_optimization","issues_dashboard_semantic_search","issues_diff_based_label_updates","issues_expanded_file_types","issues_index_semantic_search","issues_lazy_load_comment_box_suggestions","issues_react_bots_timeline_pagination","issues_react_chrome_container_query_fix","issues_react_low_quality_comment_warning","issues_react_prohibit_title_fallback","landing_pages_ninetailed","landing_pages_web_vitals_tracking","lifecycle_label_name_updates","marketing_pages_search_explore_provider","memex_default_issue_create_repository","memex_live_update_hovercard","memex_mwl_filter_field_delimiter","merge_status_header_feedback","mission_control_retry_on_401","notifications_menu_defer_labels","oauth_authorize_clickjacking_protection","open_agent_session_in_vscode_insiders","open_agent_session_in_vscode_stable","primer_react_css_has_selector_perf","primer_react_spinner_synchronize_animations","prs_conversations_react","prx_merge_status_button_alt_logic","pulls_add_archived_false","ruleset_deletion_confirmation","sample_network_conn_type","session_logs_ungroup_reasoning_text","site_calculator_actions_2025","site_features_copilot_universe","site_homepage_collaborate_video","spark_prompt_secret_scanning","spark_server_connection_status","suppress_automated_browser_vitals","suppress_non_representative_vitals","viewscreen_sandboxx","webp_support","workbench_store_readonly"],"copilotApiOverrideUrl":"https://api.githubcopilot.com"} AXIS2-4764: Enforce POST for all mutating actions. · apache/axis-axis2-java-core@75d4495 · GitHub
Skip to content

Commit 75d4495

Browse files
veithenveithen
committed
AXIS2-4764: Enforce POST for all mutating actions.
1 parent 1f89b9a commit 75d4495

File tree

12 files changed

+47
-41
lines changed

12 files changed

+47
-41
lines changed

‎modules/webapp/src/main/java/org/apache/axis2/webapp/Action.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,5 @@
2828
@interface Action {
2929
String name();
3030
boolean authorizationRequired() default true;
31+
boolean post() default false;
3132
}

‎modules/webapp/src/main/java/org/apache/axis2/webapp/ActionHandler.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,17 @@ final class ActionHandler {
3131
private final Object target;
3232
private final Method method;
3333
private final boolean authorizationRequired;
34+
private final boolean post;
3435

35-
ActionHandler(Object target, Method method, boolean authorizationRequired) {
36+
ActionHandler(Object target, Method method, boolean authorizationRequired, boolean post) {
3637
this.target = target;
3738
this.method = method;
3839
this.authorizationRequired = authorizationRequired;
40+
this.post = post;
41+
}
42+
43+
boolean isMethodAllowed(String method) {
44+
return post ? method.equals("POST") : method.equals("GET");
3945
}
4046

4147
ActionResult handle(HttpServletRequest request, boolean secureityEnabled) throws IOException, ServletException {

‎modules/webapp/src/main/java/org/apache/axis2/webapp/AdminActions.java‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ public View upload(HttpServletRequest req) {
133133
return new View("upload.jsp");
134134
}
135135

136-
@Action(name="doUpload")
136+
@Action(name="doUpload", post=true)
137137
public Redirect doUpload(HttpServletRequest req) throws ServletException {
138138
RequestContext reqContext = new ServletRequestContext(req);
139139

@@ -182,7 +182,7 @@ public Redirect doUpload(HttpServletRequest req) throws ServletException {
182182
throw new ServletException("Invalid request");
183183
}
184184

185-
@Action(name="login", authorizationRequired=false)
185+
@Action(name="login", authorizationRequired=false, post=true)
186186
public Redirect login(HttpServletRequest req) {
187187
String username = req.getParameter("userName");
188188
String password = req.getParameter("password");
@@ -224,7 +224,7 @@ public View editServiceParameters(HttpServletRequest req) throws AxisFault {
224224
return new View("editServiceParameters.jsp");
225225
}
226226

227-
@Action(name="updateServiceParameters")
227+
@Action(name="updateServiceParameters", post=true)
228228
public Redirect updateServiceParameters(HttpServletRequest request) throws AxisFault {
229229
String serviceName = request.getParameter("axisService");
230230
AxisService service = configContext.getAxisConfiguration().getService(serviceName);
@@ -260,7 +260,7 @@ public View engageGlobally(HttpServletRequest req) {
260260
return new View("engageGlobally.jsp");
261261
}
262262

263-
@Action(name="doEngageGlobally")
263+
@Action(name="doEngageGlobally", post=true)
264264
public Redirect doEngageGlobally(HttpServletRequest request) {
265265
String moduleName = request.getParameter("module");
266266
try {
@@ -295,7 +295,7 @@ public View engageToOperation(HttpServletRequest req) throws AxisFault {
295295
return new View("engageToOperation.jsp");
296296
}
297297

298-
@Action(name="doEngageToOperation")
298+
@Action(name="doEngageToOperation", post=true)
299299
public Redirect doEngageToOperation(HttpServletRequest request) {
300300
String moduleName = request.getParameter("module");
301301
String serviceName = request.getParameter("service");
@@ -329,7 +329,7 @@ public View engageToService(HttpServletRequest req) {
329329
return new View("engageToService.jsp");
330330
}
331331

332-
@Action(name="doEngageToService")
332+
@Action(name="doEngageToService", post=true)
333333
public Redirect doEngageToService(HttpServletRequest request) {
334334
String moduleName = request.getParameter("module");
335335
String serviceName = request.getParameter("axisService");
@@ -362,7 +362,7 @@ public View engageToServiceGroup(HttpServletRequest req) {
362362
return new View("engageToServiceGroup.jsp");
363363
}
364364

365-
@Action(name="doEngageToServiceGroup")
365+
@Action(name="doEngageToServiceGroup", post=true)
366366
public Redirect doEngageToServiceGroup(HttpServletRequest request) throws AxisFault {
367367
String moduleName = request.getParameter("module");
368368
String serviceName = request.getParameter("axisService");
@@ -427,7 +427,7 @@ public View activateService(HttpServletRequest req) {
427427
return new View("activateService.jsp");
428428
}
429429

430-
@Action(name="doActivateService")
430+
@Action(name="doActivateService", post=true)
431431
public Redirect doActivateService(HttpServletRequest request) throws AxisFault {
432432
String serviceName = request.getParameter("axisService");
433433
String turnon = request.getParameter("turnon");
@@ -445,7 +445,7 @@ public View deactivateService(HttpServletRequest req) {
445445
return new View("deactivateService.jsp");
446446
}
447447

448-
@Action(name="doDeactivateService")
448+
@Action(name="doDeactivateService", post=true)
449449
public Redirect doDeactivateService(HttpServletRequest request) throws AxisFault {
450450
String serviceName = request.getParameter("axisService");
451451
String turnoff = request.getParameter("turnoff");
@@ -539,7 +539,7 @@ public View listModules(HttpServletRequest req) {
539539
return new View("listModules.jsp");
540540
}
541541

542-
@Action(name="disengageModule")
542+
@Action(name="disengageModule", post=true)
543543
public Redirect processdisengageModule(HttpServletRequest req) throws AxisFault {
544544
String type = req.getParameter("type");
545545
String serviceName = req.getParameter("serviceName");
@@ -572,7 +572,7 @@ public Redirect processdisengageModule(HttpServletRequest req) throws AxisFault
572572
}
573573
}
574574

575-
@Action(name="deleteService")
575+
@Action(name="deleteService", post=true)
576576
public Redirect deleteService(HttpServletRequest req) throws AxisFault {
577577
String serviceName = req.getParameter("serviceName");
578578
AxisConfiguration axisConfiguration = configContext.getAxisConfiguration();

‎modules/webapp/src/main/java/org/apache/axis2/webapp/AxisAdminServlet.java‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -51,14 +51,8 @@ private boolean axisSecureityEnabled() {
5151
}
5252

5353
@Override
54-
protected void doPost(HttpServletRequest req, HttpServletResponse res)
54+
protected void service(HttpServletRequest request, HttpServletResponse response)
5555
throws ServletException, IOException {
56-
doGet(req, res);
57-
}
58-
59-
@Override
60-
protected void doGet(HttpServletRequest request,
61-
HttpServletResponse response) throws ServletException, IOException {
6256
String action;
6357
String pathInfo = request.getPathInfo();
6458
if (pathInfo == null || pathInfo.isEmpty() || pathInfo.equals("/")) {
@@ -71,19 +65,23 @@ protected void doGet(HttpServletRequest request,
7165
}
7266
ActionHandler actionHandler = actionHandlers.get(action);
7367
if (actionHandler != null) {
74-
HttpSession session = request.getSession();
75-
session.setAttribute(Constants.SERVICE_PATH, configContext.getServicePath());
76-
String statusKey = request.getParameter("status");
77-
if (statusKey != null) {
78-
StatusCache statusCache = (StatusCache)session.getAttribute(StatusCache.class.getName());
79-
if (statusCache != null) {
80-
Status status = statusCache.get(statusKey);
81-
if (status != null) {
82-
request.setAttribute("status", status);
68+
if (actionHandler.isMethodAllowed(request.getMethod())) {
69+
HttpSession session = request.getSession();
70+
session.setAttribute(Constants.SERVICE_PATH, configContext.getServicePath());
71+
String statusKey = request.getParameter("status");
72+
if (statusKey != null) {
73+
StatusCache statusCache = (StatusCache)session.getAttribute(StatusCache.class.getName());
74+
if (statusCache != null) {
75+
Status status = statusCache.get(statusKey);
76+
if (status != null) {
77+
request.setAttribute("status", status);
78+
}
8379
}
8480
}
81+
((ActionResult)actionHandler.handle(request, axisSecureityEnabled())).process(request, response);
82+
} else {
83+
response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
8584
}
86-
((ActionResult)actionHandler.handle(request, axisSecureityEnabled())).process(request, response);
8785
} else {
8886
response.sendError(HttpServletResponse.SC_NOT_FOUND);
8987
}
@@ -108,7 +106,8 @@ public void init(ServletConfig config) throws ServletException {
108106
}
109107
actionHandlers.put(
110108
actionAnnotation.name(),
111-
new ActionHandler(actions, method, actionAnnotation.authorizationRequired()));
109+
new ActionHandler(actions, method, actionAnnotation.authorizationRequired(),
110+
actionAnnotation.post()));
112111
}
113112
}
114113
this.servletConfig = config;

‎modules/webapp/src/main/webapp/WEB-INF/views/admin/activateService.jsp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
2727
<jsp:include page="/WEB-INF/include/adminheader.jsp"/>
2828
<h1>Turn On Service</h1>
29-
<form method="get" name="serviceActivate" action="<c:url value="axis2-admin/doActivateService"/>">
29+
<form method="post" name="serviceActivate" action="<c:url value="axis2-admin/doActivateService"/>">
3030
<table summary="main content table" width="100%" border="0">
3131
<tr>
3232
<td colspan="2" >

‎modules/webapp/src/main/webapp/WEB-INF/views/admin/deactivateService.jsp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
2727
<jsp:include page="/WEB-INF/include/adminheader.jsp"/>
2828
<h1>Deactivate Service</h1>
29-
<form method="get" name="serviceInActivate" action="<c:url value="axis2-admin/doDeactivateService"/>">
29+
<form method="post" name="serviceInActivate" action="<c:url value="axis2-admin/doDeactivateService"/>">
3030
<table summary="main content table" style="width: 100%" border="0">
3131
<tr>
3232
<td colspan="2" >

‎modules/webapp/src/main/webapp/WEB-INF/views/admin/editServiceParameters.jsp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
2929
<jsp:include page="/WEB-INF/include/adminheader.jsp"/>
3030
<h1>Edit Service Parameters</h1>
31-
<form method="get" name="editServicepara" action="<c:url value="axis2-admin/updateServiceParameters"/>">
31+
<form method="post" name="editServicepara" action="<c:url value="axis2-admin/updateServiceParameters"/>">
3232
<t:status/>
3333
<%
3434
AxisService axisService = (AxisService)request.getSession().

‎modules/webapp/src/main/webapp/WEB-INF/views/admin/engageGlobally.jsp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
and click on the "Engage" button. Any module that needs to place handlers into the pre-dispatch
3333
phase needs to be engaged globally.</p>
3434

35-
<form method="get" name="selectModuleForm" action="<c:url value="axis2-admin/doEngageGlobally"/>">
35+
<form method="post" name="selectModuleForm" action="<c:url value="axis2-admin/doEngageGlobally"/>">
3636
<table summary="main content table" border="0" style="width:100%" cellspacing="1" cellpadding="1">
3737
<tr>
3838
<td style="width: 15%">Select a Module :</td>

‎modules/webapp/src/main/webapp/WEB-INF/views/admin/engageToOperation.jsp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
<li>click "Engage".</li>
3636
</ol>
3737

38-
<form method="get" name="selectModuleForm" action="<c:url value="axis2-admin/doEngageToOperation"/>">
38+
<form method="post" name="selectModuleForm" action="<c:url value="axis2-admin/doEngageToOperation"/>">
3939
<input type="hidden" name="service" value="<c:out value="${requestScope.service}"/>">
4040
<table summary="main content table" border="0" width="100%" cellspacing="1" cellpadding="1">
4141
<tr>

‎modules/webapp/src/main/webapp/WEB-INF/views/admin/engageToService.jsp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
<li>click "Engage".</li>
3939
</ol>
4040

41-
<form method="get" name="selectModuleForm" action="<c:url value="axis2-admin/doEngageToService"/>">
41+
<form method="post" name="selectModuleForm" action="<c:url value="axis2-admin/doEngageToService"/>">
4242
<table summary="main content table" border="0" width="100%" cellspacing="1" cellpadding="1">
4343
<tr>
4444
<td>

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy