feat(Application): SpringBoot 3 upgrade - #311
Merged
Merged
Conversation
~ Conflicts: ~ pom.xml ~ src/main/java/org/wise/portal/presentation/web/controllers/author/project/TranslateProjectAPIController.java ~ src/main/java/org/wise/portal/presentation/web/controllers/news/NewsAPIController.java ~ src/main/java/org/wise/portal/presentation/web/controllers/student/ClassmateDiscussionDataController.java ~ src/main/java/org/wise/portal/presentation/web/controllers/student/ClassmateSummaryDataController.java ~ src/main/java/org/wise/portal/presentation/web/controllers/teacher/TeacherAPIController.java ~ src/main/java/org/wise/portal/spring/impl/WebSecurityConfig.java
Member
Author
|
@breity please re-review with microsoft oauth. It's been a while since your last review. All the changes to the develop branch have been merged into this PR, so it'd be good to make sure that everything is still working with Spring Boot 3. Thanks! |
breity
approved these changes
Sep 2, 2026
breity
left a comment
breity
left a comment
Member
There was a problem hiding this comment.
Looks good to me. Microsoft and Google login seem to be working. I don't see any other issues except the merge conflict that needs to be resolved.
~ Conflicts: ~ src/test/java/org/wise/portal/domain/authentication/impl/TeacherUserDetailsTest.java
Aaron-Detre
approved these changes
Sep 4, 2026
Member
Author
|
🎉 This PR is included in version 1.25.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
hirokiterashima
pushed a commit
that referenced
this pull request
Sep 9, 2026
…oints (#347) The Spring Boot 3 upgrade (#311) added anyRequest().authenticated() but the permitAll whitelist was incomplete. This re-audits the security configuration against every unguarded frontend route and fills the gaps. Static asset paths served by WebConfig resource handlers (portal scripts, themes, translations, the VLE engine, project icons) were not excluded from the security filter chain, so the login page could not load its own JS, CSS or translations for anonymous visitors. Password recovery for teachers was actively blocked: /api/teacher/forgot/** matched the /api/teacher/** role rule (requires TEACHER) before reaching the terminal rule, making recovery impossible without the role the user is trying to recover. Student forgot paths fell through to authenticated. Both are now permitted before the role rules. Remaining anonymous endpoints are now explicitly permitted: the contact form, news, announcements (called on every page load by the root component), project info (used by the contact and library pages), Google registration checks, project preview, survey entry, and framework error dispatch paths. Remove @EnableWebSecurity(debug = true) which logs request headers and session cookies on every request. Gate DebugController behind @Profile(dev) and remove its permitAll rule so it is not registered or reachable in production. Remove the duplicate /api/user/info permitAll.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Test Prep
Add new authorized redirect URI to google cloud console
http://localhost/login/oauth2/code/googleRun mvn clean compile
Restart WISE-Docker-Dev
Test