[OpenNMS/opennms] 863521: NMS-20180: Narrow anonymous menu-asset access to /...

  Branch: refs/heads/jira/NMS-20180-more-menu-issues
  Home:   https://github.com/OpenNMS/opennms
  Commit: 863521da98eb3a518f12fa9eaf7c773bd16eef09
      https://github.com/OpenNMS/opennms/commit/863521da98eb3a518f12fa9eaf7c773bd16eef09
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml
    M opennms-webapp/src/main/webapp/includes/bootstrap.jsp
    M smoke-test/src/test/java/org/opennms/smoketest/WebappIT.java

  Log Message:
  -----------
  NMS-20180: Narrow anonymous menu-asset access to /ui-components/assets/**

The unpacked dist-menu artifact also ships an index.html (the Vite build
input) at /ui-components/, which nothing links to and which should not be
anonymously reachable; only assets/** needs the ROLE_ANONYMOUS rule from
NMS-20174. Document the deliberate login-page preload in bootstrap.jsp,
and pin the NMS-20174 access/quiet fixes with WebappIT smoke tests:
anonymous asset access with correct content types, index.html requiring
authentication, and login.jsp never executing the menu bundle.


  Commit: 5b694f1def86dfc713ca653b8d450cae8eac2211
      https://github.com/OpenNMS/opennms/commit/5b694f1def86dfc713ca653b8d450cae8eac2211
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M features/springframework-security/src/main/java/org/opennms/web/springframework/security/LoginModuleUtils.java
    M features/springframework-security/src/test/java/org/opennms/web/springframework/security/LoginModuleUtilsTest.java

  Log Message:
  -----------
  NMS-20180: Make saved-request URL matching independent of the default locale

Under a Turkish default locale, locale-sensitive toLowerCase() turns "I"
into a dotless ı, so a saved "/API" request would slip past the "/api"
prefix check added in NMS-20174. Use Locale.ROOT and cover it with a test
that runs the matcher under tr-TR.


  Commit: 75fe9375e39c4fafbed5014fc35a2c559a2d78e5
      https://github.com/OpenNMS/opennms/commit/75fe9375e39c4fafbed5014fc35a2c559a2d78e5
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M ui/tests/components/Menu/UserSelfServiceMenuItem.test.ts

  Log Message:
  -----------
  NMS-20180: Assert regular menu items do not cancel the anchor navigation

The "does not cancel navigation for regular items" test only checked that
performLogout was not called, so an unconditional preventDefault() (breaking
navigation for every self-service item) would still pass. Assert
event.defaultPrevented is false so the test covers what its name claims.


Compare: https://github.com/OpenNMS/opennms/compare/6fabacc16615...75fe9375e39c

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs