From f09262ac489cc2b3bbca450fbca411cd91c89728 Mon Sep 17 00:00:00 2001
From: zzz <zzz@mail.i2p>
Date: Fri, 17 Jan 2025 12:16:27 +0000
Subject: [PATCH] i2psnark: require POST on all forms

---
 .../java/src/org/klomp/snark/web/I2PSnarkServlet.java         | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java b/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
index f802a8fb5..810ebc0c0 100644
--- a/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
+++ b/apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java
@@ -291,7 +291,9 @@ public class I2PSnarkServlet extends BasicServlet {
 
         String nonce = req.getParameter("nonce");
         if (nonce != null) {
-            if (nonce.equals(String.valueOf(_nonce)))
+            // the clear messages button is a GET
+            if ((method.equals("POST") || "Clear".equals(req.getParameter("action"))) &&
+                nonce.equals(String.valueOf(_nonce)))
                 processRequest(req);
             else  // nonce is constant, shouldn't happen
                 _manager.addMessage("Please retry form submission (bad nonce)");