Fixed: Security nonce not verified correctly.

jogetoss · Dec 7, 2021 · 4394712 · 4394712
1 parent 079ae15
commit 4394712
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/pom.xml b/pom.xml
@@ -4,7 +4,7 @@
     <groupId>org.joget.plugin</groupId>
     <artifactId>section-tabs</artifactId>
     <packaging>bundle</packaging>
-    <version>7.0.6</version>
+    <version>7.0.7</version>
     <name>section-tabs</name>
     <url>http://www.joget.org</url>
     <build>

diff --git a/src/main/java/org/joget/plugin/SectionTabs.java b/src/main/java/org/joget/plugin/SectionTabs.java
@@ -23,7 +23,7 @@ public String getName() {
 
     @Override
     public String getVersion() {
-        return "7.0.6";
+        return "7.0.7";
     }
 
     @Override

diff --git a/src/main/java/org/joget/plugin/SectionTabsChild.java b/src/main/java/org/joget/plugin/SectionTabsChild.java
@@ -30,7 +30,7 @@ public String getName() {
 
     @Override
     public String getVersion() {
-        return "7.0.6";
+        return "7.0.7";
     }
 
     @Override
@@ -114,7 +114,7 @@ public void webService(HttpServletRequest request, HttpServletResponse response)
         formData.setActivityId(StringUtil.escapeString(request.getParameter("activityId"), StringUtil.TYPE_HTML, null));
 
         String nonce = request.getParameter("_nonce");
-        if (!SecurityUtil.verifyNonce(nonce, new String[]{"SectionTabsChild", request.getParameter("_elementId"), nonce})) {
+        if (!SecurityUtil.verifyNonce(nonce, new String[]{"SectionTabsChild", request.getParameter("_elementId")})) {
             response.setStatus(HttpServletResponse.SC_FORBIDDEN);
             return;
         }