Branch: refs/heads/RN-98 Home: https://github.com/xwiki-contrib/application-releasenotes Commit: 91f7a0f760c7daf64fe8a2636c296a4b47d90aa3 https://github.com/xwiki-contrib/application-releasenotes/commit/91f7a0f760c... Author: Vincent Massol <[email protected]> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/Change/ReleaseNotesChangesMacro.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/HomeReleaseChanges.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/HomeReleaseNotes.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/MigrationFrom1x.xml A application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/CSRFTokenScriptServiceStub.java M application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/HomeReleaseNotesPageTest.java Log Message: ----------- RN-98: Validate a form token in the release note and change entry creation actions * Only run the addReleaseNotes, addChange, useradd, adminadd and devadd actions, and the 1.x migration, when the request carries back a valid form token, so a state-changing request cannot be triggered from another site. * Carry the token in a hidden form_token field of each creation form and in the migration link. * Add page tests asserting a release-note creation request creates nothing without a valid token and creates the release note with one. Co-Authored-By: Claude Opus 4.8 <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/application-releasenotes/settings/notificat...