OO-919: send a 400 if the action is not a number (instead of red screen)

src/main/java/org/olat/core/gui/components/Window.java

@@ -26,6 +26,7 @@
 
 package org.olat.core.gui.components;
 
+import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Iterator;
 import java.util.List;
@@ -43,6 +44,7 @@ import org.olat.core.gui.GUIInterna;
 import org.olat.core.gui.GlobalSettings;
 import org.olat.core.gui.UserRequest;
 import org.olat.core.gui.Windows;
+import org.olat.core.gui.components.form.flexible.impl.InvalidRequestParameterException;
 import org.olat.core.gui.components.htmlheader.jscss.CustomCSS;
 import org.olat.core.gui.components.panel.Panel;
 import org.olat.core.gui.control.ChiefController;
@@ -494,6 +496,12 @@ public class Window extends Container {
 						}
 						
 						wbackofficeImpl.pushCommands(request, response);
+					}  catch (InvalidRequestParameterException e) {
+						try {
+							response.sendError(HttpServletResponse.SC_BAD_REQUEST);
+						} catch (IOException e1) {
+							log.error("An exception occured while handling the invalid request parameter exception...", e1);
+						}
 					} catch (Throwable th) {
 						// in any case, try to inform the user appropriately.
 						// a) error while dispatching (e.g. db problem, npe, ...)

src/main/java/org/olat/core/gui/components/form/flexible/impl/Form.java

@@ -250,8 +250,12 @@ public class Form extends LogDelegator {
 				// see also OLAT-3141
 				implicitFormSubmit = true;
 			}
-		}else{
-			action = Integer.valueOf(dispatchAction);
+		} else {
+			try {
+				action = Integer.valueOf(dispatchAction);
+			} catch(Exception e) {
+				throw new InvalidRequestParameterException();
+			}
 		}
 		hasAlreadyFired = false;
 		isValidAndSubmitted = false;

src/main/java/org/olat/core/gui/components/form/flexible/impl/InvalidRequestParameterException.java

+/**
+ * <a href="http://www.openolat.org">
+ * OpenOLAT - Online Learning and Training</a><br>
+ * <p>
+ * Licensed under the Apache License, Version 2.0 (the "License"); <br>
+ * you may not use this file except in compliance with the License.<br>
+ * You may obtain a copy of the License at the
+ * <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache homepage</a>
+ * <p>
+ * Unless required by applicable law or agreed to in writing,<br>
+ * software distributed under the License is distributed on an "AS IS" BASIS, <br>
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. <br>
+ * See the License for the specific language governing permissions and <br>
+ * limitations under the License.
+ * <p>
+ * Initial code contributed and copyrighted by<br>
+ * frentix GmbH, http://www.frentix.com
+ * <p>
+ */
+package org.olat.core.gui.components.form.flexible.impl;
+
+/**
+ * 
+ * Initial date: 20.12.2013<br>
+ * @author srosse, stephane.rosse@frentix.com, http://www.frentix.com
+ *
+ */
+public class InvalidRequestParameterException extends RuntimeException {
+
+	private static final long serialVersionUID = -6658182207801689742L;
+
+}

src/main/java/org/olat/dispatcher/AuthenticatedDispatcher.java

@@ -25,6 +25,7 @@
 
 package org.olat.dispatcher;
 
+import java.io.IOException;
 import java.util.Locale;
 
 import javax.servlet.http.HttpServletRequest;
@@ -41,6 +42,7 @@ import org.olat.core.gui.UserRequestImpl;
 import org.olat.core.gui.WindowSettings;
 import org.olat.core.gui.Windows;
 import org.olat.core.gui.components.Window;
+import org.olat.core.gui.components.form.flexible.impl.InvalidRequestParameterException;
 import org.olat.core.gui.control.ChiefController;
 import org.olat.core.gui.control.WindowControl;
 import org.olat.core.gui.exception.MsgFactory;
@@ -197,6 +199,12 @@ public class AuthenticatedDispatcher implements Dispatcher {
 					log.error("Invalid URI in AuthenticatedDispatcher: " + request.getRequestURI());
 				}
 			}
+		} catch (InvalidRequestParameterException e) {
+			try {
+				response.sendError(HttpServletResponse.SC_BAD_REQUEST);
+			} catch (IOException e1) {
+				log.error("An exception occured while handling the invalid request parameter exception...", e1);
+			}
 		} catch (Throwable th) {
 			// Do not log as Warn or Error here, log as ERROR in MsgFactory => ExceptionWindowController throws an OLATRuntimeException 
 			log.debug("handleError in AuthenticatedDispatcher throwable=" + th);

src/main/java/org/olat/dispatcher/DMZDispatcher.java

@@ -25,6 +25,7 @@
 
 package org.olat.dispatcher;
 
+import java.io.IOException;
 import java.util.List;
 import java.util.Map;
 
@@ -40,6 +41,7 @@ import org.olat.core.gui.UserRequest;
 import org.olat.core.gui.UserRequestImpl;
 import org.olat.core.gui.Windows;
 import org.olat.core.gui.components.Window;
+import org.olat.core.gui.components.form.flexible.impl.InvalidRequestParameterException;
 import org.olat.core.gui.control.ChiefController;
 import org.olat.core.gui.control.ChiefControllerCreator;
 import org.olat.core.gui.control.generic.dtabs.DTabs;
@@ -274,6 +276,12 @@ public class DMZDispatcher implements Dispatcher {
 				}
 				window.dispatchRequest(ureq);
 			}
+		} catch (InvalidRequestParameterException e) {
+			try {
+				response.sendError(HttpServletResponse.SC_BAD_REQUEST);
+			} catch (IOException e1) {
+				log.error("An exception occured while handling the invalid request parameter exception...", e1);
+			}
 		} catch (Throwable th) {
 			try {
 				ChiefController msgcc = MsgFactory.createMessageChiefController(ureq, th);
@@ -282,8 +290,7 @@ public class DMZDispatcher implements Dispatcher {
 				// do not dispatch (render only), since this is a new Window created as
 				// a result of another window's click.
 			} catch (Throwable t) {
-				log.error("An exception occured while handling the exception...",t);
-
+				log.error("An exception occured while handling the exception...", t);
 			}
 		}
 	}