It generally might not occure but in some conditions the previous code
could be used to inject something into response by manipulating the
origin header to include some \n or \r.
These sequences should not occure in results CORS headers.

Patch replaces all \n or \r in origin header with a white space char.
Newer servlet containers like Tomcat 7.x fix this problem, but it might
be a good idea to fix this issue within ARSnova.

See: https://www.owasp.org/index.php/HTTP_Response_Splitting

NovaEvents is derived from ApplicationEvent which extends EventObject.
EventObject implements Serializable.

It is bad practice if defined instance fields within NovaEvents
derived classes do not implement Serializable.

A boxed primitive is created from a String in
* RangeAspect#handlePaginationRange()
* LoginController#dialog()
just to extract the unboxed primitive value with Integer#valueOf().
This creates an Integer object. It is more efficient to use parseInt()
which creates a primitive int.

Corrected random indention in LoginController

In getSkillQuestion() a call to stubQuestions.get() contained an argument
with an incompatible class. Session will be converted into String using
toString() but this is not what was intended to do here.

In saveQuestion() the CouchDB document ID was used, but the sessions
keyword should have been used instead.

User object will be serialized into a String using toString() but this
should not be done in a unit test.

remove swagger annotation from feedbackcontroller, coursecontroller and getter and setter for sortOrder

remove spingfox for ApiIgnore direction
use swagger-maven-plugin to generate swagger.json before compiling rather than
 dynamically generate it on request

Daniel Gerhardt authored 9 years ago and Tom Käsler committed 9 years ago

Reasons:
* not used consistently
* Java signatures are not helpful
* Return type should not be hard-coded in a String

Statistics model now correctly uses value instead of notes for
documentation of properties.

Daniel Gerhardt authored 9 years ago and Tom Käsler committed 9 years ago

* Fix inconsistent whitespaces
* Remove unused imports

Tjark Wilhelm Hoeck authored 9 years ago and Tom Käsler committed 9 years ago

added labeled deprecated rest endpoints to api documentation, commentet and included the feedbackController

Tjark Wilhelm Hoeck authored 9 years ago and Tom Käsler committed 9 years ago

Edited tests to support the new EnableWebMvc Annotation from the ExtraConfig file. No more test errors.

The config parameter is now used instead of the hard-coded value '5'.

All feature settings are replaced by the received object so the use of
PATCH does not make sense here. The session is "patched" but the HTTP
verb always relates to the URL which refers explicitly to features in
this case.

See https://tools.ietf.org/html/rfc5789.