From 96bffc7d8333dd97a190d66dc0a3371cca005bc3 Mon Sep 17 00:00:00 2001 From: Alex O'Ree Date: Fri, 28 Aug 2026 14:30:39 -0400 Subject: [PATCH 1/4] JSPWIKI-1303 see jira for details --- .../main/resources/META-INF/web-fragment.xml | 99 ------------------- jspwiki-war/src/main/webapp/WEB-INF/web.xml | 74 ++++++++++++++ 2 files changed, 74 insertions(+), 99 deletions(-) delete mode 100644 jspwiki-http/src/main/resources/META-INF/web-fragment.xml diff --git a/jspwiki-http/src/main/resources/META-INF/web-fragment.xml b/jspwiki-http/src/main/resources/META-INF/web-fragment.xml deleted file mode 100644 index ca276a2d6b..0000000000 --- a/jspwiki-http/src/main/resources/META-INF/web-fragment.xml +++ /dev/null @@ -1,99 +0,0 @@ - - - - - - CsrfProtectionFilter - org.apache.wiki.http.filter.CsrfProtectionFilter - - - - CsrfProtectionFilter - /* - - - - - COEPFilter - org.apache.wiki.http.filter.COEPFilter - - - - COEPFilter - /* - - - - CORPFilter - org.apache.wiki.http.filter.CORPFilter - - - - CORPFilter - /* - - - - ContentTypeOptionsFilter - org.apache.wiki.http.filter.ContentTypeOptionsFilter - - - - ContentTypeOptionsFilter - /* - - - - CrossDomainFilter - org.apache.wiki.http.filter.CrossDomainFilter - - - - CrossDomainFilter - /* - - - - ReferrerPolicyFilter - org.apache.wiki.http.filter.ReferrerPolicyFilter - - - - ReferrerPolicyFilter - /* - - - - STSFilter - org.apache.wiki.http.filter.STSFilter - - - - STSFilter - /* - - - \ No newline at end of file diff --git a/jspwiki-war/src/main/webapp/WEB-INF/web.xml b/jspwiki-war/src/main/webapp/WEB-INF/web.xml index 83da270d2d..86bf0d69ae 100644 --- a/jspwiki-war/src/main/webapp/WEB-INF/web.xml +++ b/jspwiki-war/src/main/webapp/WEB-INF/web.xml @@ -86,6 +86,80 @@ /wiki/* *.jsp + + + CsrfProtectionFilter + org.apache.wiki.http.filter.CsrfProtectionFilter + + + + CsrfProtectionFilter + /* + + + + + COEPFilter + org.apache.wiki.http.filter.COEPFilter + + + + COEPFilter + /* + + + + CORPFilter + org.apache.wiki.http.filter.CORPFilter + + + + CORPFilter + /* + + + + ContentTypeOptionsFilter + org.apache.wiki.http.filter.ContentTypeOptionsFilter + + + + ContentTypeOptionsFilter + /* + + + + CrossDomainFilter + org.apache.wiki.http.filter.CrossDomainFilter + + + + CrossDomainFilter + /* + + + + ReferrerPolicyFilter + org.apache.wiki.http.filter.ReferrerPolicyFilter + + + + ReferrerPolicyFilter + /* + + + + STSFilter + org.apache.wiki.http.filter.STSFilter + + + + STSFilter + /* + 10 From 36046bbb89de9c3683adb182e03fe5b7bdfd7a41 Mon Sep 17 00:00:00 2001 From: Alex O'Ree Date: Sun, 30 Aug 2026 08:47:12 -0400 Subject: [PATCH 2/4] JSPWIKI-1303 see jira for details --- jspwiki-war/src/main/webapp/Delete.jsp | 5 +++++ jspwiki-war/src/main/webapp/Rename.jsp | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/jspwiki-war/src/main/webapp/Delete.jsp b/jspwiki-war/src/main/webapp/Delete.jsp index 1081b5c20e..345341eab2 100644 --- a/jspwiki-war/src/main/webapp/Delete.jsp +++ b/jspwiki-war/src/main/webapp/Delete.jsp @@ -29,6 +29,7 @@ <%@ page import="org.apache.wiki.tags.BreadcrumbsTag" %> <%@ page import="org.apache.wiki.tags.BreadcrumbsTag.FixedQueue" %> <%@ page import="org.apache.wiki.ui.TemplateManager" %> +<%@ page import="org.apache.wiki.http.filter.CsrfProtectionFilter" %> <%@ page import="org.apache.wiki.util.HttpUtil" %> <%@ page import="org.apache.wiki.util.TextUtil" %> <%@ page errorPage="/Error.jsp" %> @@ -39,6 +40,10 @@ %> <% + if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) { + response.sendRedirect( "/error/Forbidden.html" ); + return; + } Engine wiki = Wiki.engine().find( getServletConfig() ); // Create wiki context and check for authorization Context wikiContext = Wiki.context().create( wiki, request, ContextEnum.PAGE_DELETE.getRequestContext() ); diff --git a/jspwiki-war/src/main/webapp/Rename.jsp b/jspwiki-war/src/main/webapp/Rename.jsp index d456ac2632..8eeb57f5ce 100644 --- a/jspwiki-war/src/main/webapp/Rename.jsp +++ b/jspwiki-war/src/main/webapp/Rename.jsp @@ -32,6 +32,7 @@ <%@ page import="org.apache.wiki.tags.BreadcrumbsTag.FixedQueue" %> <%@ page import="org.apache.wiki.ui.TemplateManager" %> <%@ page import="org.apache.wiki.util.TextUtil" %> +<%@ page import="org.apache.wiki.http.filter.CsrfProtectionFilter" %> <%@ page errorPage="/Error.jsp" %> <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %> <%@ taglib prefix="fmt" uri="jakarta.tags.fmt" %> @@ -41,6 +42,10 @@ %> <% + if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) { + response.sendRedirect( "/error/Forbidden.html" ); + return; + } Engine wiki = Wiki.engine().find( getServletConfig() ); // Create wiki context and check for authorization Context wikiContext = Wiki.context().create( wiki, request, ContextEnum.PAGE_RENAME.getRequestContext() ); From 286dfcbac035e4048572dd83af66428e38ea8109 Mon Sep 17 00:00:00 2001 From: Alex O'Ree Date: Sun, 30 Aug 2026 13:58:26 -0400 Subject: [PATCH 3/4] NOJIRA log reduction --- .../src/main/java/org/apache/wiki/util/PropertyReader.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jspwiki-util/src/main/java/org/apache/wiki/util/PropertyReader.java b/jspwiki-util/src/main/java/org/apache/wiki/util/PropertyReader.java index e076e34951..c70f1bca6e 100644 --- a/jspwiki-util/src/main/java/org/apache/wiki/util/PropertyReader.java +++ b/jspwiki-util/src/main/java/org/apache/wiki/util/PropertyReader.java @@ -469,7 +469,7 @@ static void setWorkDir( final ServletContext servletContext, final Properties pr LOG.info("ServletContext's temporary directory not found. Setting jspwiki.workDir to system's temporary directory: {}", defaultTmpDir); } } else { - LOG.info("jspwiki.workDir is already set to: {}", workDir); + LOG.debug("jspwiki.workDir is already set to: {}", workDir); } } From 2c410d8ddd52fdb9c8c43a19c784bfc032729e8d Mon Sep 17 00:00:00 2001 From: Alex O'Ree Date: Sun, 30 Aug 2026 13:58:48 -0400 Subject: [PATCH 4/4] JSPWII-1303 see jira for details --- jspwiki-war/src/main/webapp/Install.jsp | 5 +++++ jspwiki-war/src/main/webapp/Workflow.jsp | 9 +++++++++ 2 files changed, 14 insertions(+) diff --git a/jspwiki-war/src/main/webapp/Install.jsp b/jspwiki-war/src/main/webapp/Install.jsp index 0f7a7fd285..7c578959b5 100644 --- a/jspwiki-war/src/main/webapp/Install.jsp +++ b/jspwiki-war/src/main/webapp/Install.jsp @@ -29,6 +29,7 @@ <%@ page import="org.apache.logging.log4j.LogManager" %> <%@ page import="java.util.ResourceBundle" %> <%@ page import="java.text.MessageFormat" %> +<%@ page import="org.apache.wiki.http.filter.CsrfProtectionFilter" %> <%@ taglib prefix="fmt" uri="jakarta.tags.fmt" %> @@ -54,6 +55,10 @@ ResourceBundle rb = Preferences.getBundle( wikiContext, "CoreResources" ); // If user hit "submit" button, validate and install them if( request.getParameter("submit") != null ) { + if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) { + response.sendRedirect( "/error/Forbidden.html" ); + return; + } validated = installer.validateProperties(); if ( validated ) { diff --git a/jspwiki-war/src/main/webapp/Workflow.jsp b/jspwiki-war/src/main/webapp/Workflow.jsp index 67d26388db..23b4721867 100644 --- a/jspwiki-war/src/main/webapp/Workflow.jsp +++ b/jspwiki-war/src/main/webapp/Workflow.jsp @@ -34,6 +34,7 @@ <%@ page import="org.apache.wiki.workflow.NoSuchOutcomeException" %> <%@ page import="org.apache.wiki.workflow.Outcome" %> <%@ page import="org.apache.wiki.workflow.Workflow" %> +<%@ page import="org.apache.wiki.http.filter.CsrfProtectionFilter" %> <%@ page import="org.apache.wiki.workflow.WorkflowManager" %> <%@ page errorPage="/Error.jsp" %> <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %> @@ -55,6 +56,10 @@ if( "decide".equals(request.getParameter("action")) ) { + if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) { + response.sendRedirect( "/error/Forbidden.html" ); + return; + } try { // Extract parameters for decision ID & decision outcome @@ -78,6 +83,10 @@ } if( "abort".equals(request.getParameter("action")) ) { + if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) { + response.sendRedirect( "/error/Forbidden.html" ); + return; + } try { // Extract parameters for decision ID & decision outcome