move csrf check to save action
%>
<%
- if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) {
- response.sendRedirect( "/error/Forbidden.html" );
- return;
- }
Engine wiki = Wiki.engine().find( getServletConfig() );
// Create wiki context and check for authorization
Context wikiContext = Wiki.context().create( wiki, request, ContextEnum.WIKI_CREATE_GROUP.getRequestContext() );
// Are we saving the group?
if( "save".equals( request.getParameter( "action" ) ) ) {
+ if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) {
+ response.sendRedirect( "/error/Forbidden.html" );
+ return;
+ }
// Validate the group
groupMgr.validateGroup( wikiContext, group );
