Archived
austin
44fa37b68e
"Add something new" could not create a product. It was not the upload limit raised in #14: the post never got as far as multipart parsing. Thymeleaf inserts the hidden _csrf input while it processes a th:action. Five forms were written with a plain action= instead, so Thymeleaf passed the tag through untouched and they posted with no token. Spring Security answers 403, Spring renders the site's own error page, and NOTHING is logged at ERROR -- which is why the app log was completely clean while the form was broken. From the outside it looked like the upload silently failed; the request was rejected before any of our code ran. The four that mattered: add an item, add a category, add a catering table, edit the page notes. The fifth was Sign out in the admin layout, on every admin page, which had been failing the same way. Counted rather than named in the test -- /admin renders 89 forms and carried 86 tokens -- so a form added later is covered without anyone remembering to extend it. Two notes on the previous change while this is fresh. The 403 probe I used to "verify" the raised upload limit proved nothing: CSRF is checked before the body is parsed, which is exactly why a 5 KB and a 3 MB body both came back 403. And the @ExceptionHandler added in #14 only catches an over-sized file if Tomcat has not already thrown during parameter parsing, which it does when a filter reads a parameter first -- so it is narrower than its comment claims. Left alone here rather than widened on a guess; the size path needs a real over-sized upload to characterise.