The Vulnerability History Project

Merged from trunk

      WW-3858
Decouple token names from their respective session attribute names [from revision 1368827]

git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/branches/STRUTS_2_3_4_X@1368946 13f79535-47bb-0310-9956-ffa450edef68

by Jill the Mastiff 2012-08-03 13:40:01 UTC

commit 1081c52be93abfd2f33ba8453c676e3edcedec8b

Struts Fix Session Attribute CSRF CVE-2012-4386

core/src/main/java/org/apache/struts2/interceptor/ExecuteAndWaitInterceptor.java

+2 -3

core/src/main/java/org/apache/struts2/interceptor/TokenSessionStoreInterceptor.java

+2 -4

core/src/main/java/org/apache/struts2/util/TokenHelper.java

+29 -57

core/src/test/java/org/apache/struts2/util/TokenHelperTest.java

+4 -20

core/src/test/java/org/apache/struts2/views/jsp/ui/TokenTagTest.java

+3 -4

expand_less