i2psnark: require POST on all forms

2026-09-16 12:42:51 +00:00 · 2025-01-17 12:16:27 +00:00
parent eca0ba4dd7
commit f09262ac48
1 changed files with 3 additions and 1 deletions
@@ -291,7 +291,9 @@ public class I2PSnarkServlet extends BasicServlet {

        String nonce = req.getParameter("nonce");
        if (nonce != null) {
-            if (nonce.equals(String.valueOf(_nonce)))
+            // the clear messages button is a GET
+            if ((method.equals("POST") || "Clear".equals(req.getParameter("action"))) &&
+                nonce.equals(String.valueOf(_nonce)))
                processRequest(req);
            else  // nonce is constant, shouldn't happen
                _manager.addMessage("Please retry form submission (bad nonce)");