You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[BUG] CSRF token parameter logged in OpenAllModules servlet #972
src/main/java/servlets/admin/moduleManagement/OpenAllModules.java logs the submitted CSRF token on every request, before the admin session is validated:
log4j2.properties sets the servlets logger to debug and sends it to the rolling log file, so this runs by default and puts valid admin CSRF tokens in the log.
It also throws a NullPointerException when the csrfToken parameter is missing, because .toString() is called on null.
Fix: remove the line, or log only whether the parameter was present.
Activity
fix: stop logging CSRF tokens in Register and OpenAllModules (#971, #972