[OpenNMS/opennms] 2321fe: NMS-20180: Narrow anonymous menu-asset access to /...

  Branch: refs/heads/jira/NMS-20180-more-menu-issues
  Home:   https://github.com/OpenNMS/opennms
  Commit: 2321fe8eb470bb9c297ab13e24d9e5478a33b651
      https://github.com/OpenNMS/opennms/commit/2321fe8eb470bb9c297ab13e24d9e5478a33b651
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-13 (Thu, 13 Aug 2026)

  Changed paths:
    M opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml
    M opennms-webapp/src/main/webapp/includes/bootstrap.jsp
    M smoke-test/src/test/java/org/opennms/smoketest/WebappIT.java

  Log Message:
  -----------
  NMS-20180: Narrow anonymous menu-asset access to /ui-components/assets/**

The unpacked dist-menu artifact also ships an index.html (the Vite build
input) at /ui-components/, which nothing links to and which should not be
anonymously reachable; only assets/** needs the ROLE_ANONYMOUS rule from
NMS-20174. Document the deliberate login-page preload in bootstrap.jsp,
and pin the NMS-20174 access/quiet fixes with WebappIT smoke tests:
anonymous asset access with correct content types, index.html requiring
authentication, and login.jsp never executing the menu bundle.


  Commit: 624359ca31843ba7b28a16a29542a74699ae6a9d
      https://github.com/OpenNMS/opennms/commit/624359ca31843ba7b28a16a29542a74699ae6a9d
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-13 (Thu, 13 Aug 2026)

  Changed paths:
    M features/springframework-security/src/main/java/org/opennms/web/springframework/security/LoginModuleUtils.java
    M features/springframework-security/src/test/java/org/opennms/web/springframework/security/LoginModuleUtilsTest.java

  Log Message:
  -----------
  NMS-20180: Make saved-request URL matching independent of the default locale

Under a Turkish default locale, locale-sensitive toLowerCase() turns "I"
into a dotless ı, so a saved "/API" request would slip past the "/api"
prefix check added in NMS-20174. Use Locale.ROOT and cover it with a test
that runs the matcher under tr-TR.


  Commit: 6fabacc1661501d87a49044c323a766e0faef704
      https://github.com/OpenNMS/opennms/commit/6fabacc1661501d87a49044c323a766e0faef704
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-13 (Thu, 13 Aug 2026)

  Changed paths:
    M ui/tests/components/Menu/UserSelfServiceMenuItem.test.ts

  Log Message:
  -----------
  NMS-20180: Assert regular menu items do not cancel the anchor navigation

The "does not cancel navigation for regular items" test only checked that
performLogout was not called, so an unconditional preventDefault() (breaking
navigation for every self-service item) would still pass. Assert
event.defaultPrevented is false so the test covers what its name claims.


Compare: https://github.com/OpenNMS/opennms/compare/2321fe8eb470%5E...6fabacc16615

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs