Branch: refs/heads/master Home: https://github.com/xwiki-contrib/application-releasenotes Commit: 91f7a0f760c7daf64fe8a2636c296a4b47d90aa3 https://github.com/xwiki-contrib/application-releasenotes/commit/91f7a0f760c... Author: Vincent Massol <[email protected]> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/Change/ReleaseNotesChangesMacro.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/HomeReleaseChanges.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/HomeReleaseNotes.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/MigrationFrom1x.xml A application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/CSRFTokenScriptServiceStub.java M application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/HomeReleaseNotesPageTest.java Log Message: ----------- RN-98: Validate a form token in the release note and change entry creation actions * Only run the addReleaseNotes, addChange, useradd, adminadd and devadd actions, and the 1.x migration, when the request carries back a valid form token, so a state-changing request cannot be triggered from another site. * Carry the token in a hidden form_token field of each creation form and in the migration link. * Add page tests asserting a release-note creation request creates nothing without a valid token and creates the release note with one. Co-Authored-By: Claude Opus 4.8 <[email protected]> Commit: 34a7d2cf2990e6f5814639d4014cc3544e544eb2 https://github.com/xwiki-contrib/application-releasenotes/commit/34a7d2cf299... Author: Vincent Massol <[email protected]> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M application-releasenotes-test/application-releasenotes-test-docker/src/test/it/org/xwiki/releasenotes/test/ui/ReleaseNotesIT.java Log Message: ----------- RN-98: Validate a form token in the release note and change entry creation actions * Pass the form token in the functional test where it triggers the creation actions by navigating to their URL directly, matching the form_token the application's own forms now submit. Co-Authored-By: Claude Opus 4.8 <[email protected]> Commit: c79c3999e26cb09b23d97ed55d8c0a5a313e5d5a https://github.com/xwiki-contrib/application-releasenotes/commit/c79c3999e26... Author: Vincent Massol <[email protected]> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M application-releasenotes-test/application-releasenotes-test-docker/src/test/it/org/xwiki/releasenotes/test/ui/ReleaseNotesIT.java M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/Change/ReleaseNotesChangesMacro.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/HomeReleaseChanges.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/HomeReleaseNotes.xml M application-releasenotes-ui/src/main/resources/ReleaseNotes/Code/MigrationFrom1x.xml A application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/CSRFTokenScriptServiceStub.java M application-releasenotes-ui/src/test/java/org/xwiki/releasenotes/HomeReleaseNotesPageTest.java Log Message: ----------- Merge pull request #40 from xwiki-contrib/RN-98 RN-98: Validate a form token in the release note and change entry creation actions Compare: https://github.com/xwiki-contrib/application-releasenotes/compare/2422a5a877... To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/application-releasenotes/settings/notificat...