diff --git a/core/src/main/java/hudson/model/Hudson.java b/core/src/main/java/hudson/model/Hudson.java index 3f6454d8bc255d017f3b62c20d0c49d292c976f8..0d18184d94727c9f24d4d180e8b631c31f2da901 100644 --- a/core/src/main/java/hudson/model/Hudson.java +++ b/core/src/main/java/hudson/model/Hudson.java @@ -2281,7 +2281,6 @@ public final class Hudson extends Node implements ItemGroup, Stapl public void setCrumbIssuer(CrumbIssuer issuer) { crumbIssuer = issuer; - CrumbFilter.get(servletContext).setCrumbIssuer(issuer); } public void setUseCrumbs(Boolean use) { diff --git a/core/src/main/java/hudson/security/csrf/CrumbFilter.java b/core/src/main/java/hudson/security/csrf/CrumbFilter.java index 43fe9f29bd8d82aace4eb58c220e994eba03c887..ab9b8096447a1a72bffec6647a7742781f0a2dfb 100644 --- a/core/src/main/java/hudson/security/csrf/CrumbFilter.java +++ b/core/src/main/java/hudson/security/csrf/CrumbFilter.java @@ -5,6 +5,8 @@ */ package hudson.security.csrf; +import hudson.model.Hudson; + import java.io.IOException; import java.util.Enumeration; import java.util.logging.Logger; @@ -27,38 +29,21 @@ import javax.servlet.http.HttpServletResponse; * */ public class CrumbFilter implements Filter { - - private volatile CrumbIssuer crumbIssuer; - - public CrumbIssuer getCrumbIssuer() { - return crumbIssuer; - } - - public void setCrumbIssuer(CrumbIssuer issuer) { - crumbIssuer = issuer; - } - /** - * Gets the {@link CrumbFilter} created for the given {@link ServletContext}. + * Because servlet containers generally don't specify the ordering of the initialization + * (and different implementations indeed do this differently --- See HUDSON-3878), + * we cannot use Hudson to the CrumbIssuer into CrumbFilter eagerly. */ - public static CrumbFilter get(ServletContext context) { - return (CrumbFilter) context.getAttribute(CrumbFilter.class.getName()); + public CrumbIssuer getCrumbIssuer() { + return Hudson.getInstance().getCrumbIssuer(); } - /** - * {@inheritDoc} - */ public void init(FilterConfig filterConfig) throws ServletException { - // this is how we make us available to the rest of Hudson. - filterConfig.getServletContext().setAttribute(CrumbFilter.class.getName(), this); } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { - if (crumbIssuer == null) { - chain.doFilter(request, response); - return; - } - if (!(request instanceof HttpServletRequest)) { + CrumbIssuer crumbIssuer = getCrumbIssuer(); + if (crumbIssuer == null || !(request instanceof HttpServletRequest)) { chain.doFilter(request, response); return; }