It generally might not occure but in some conditions the previous code
could be used to inject something into response by manipulating the
origin header to include some \n or \r.
These sequences should not occure in results CORS headers.

Patch replaces all \n or \r in origin header with a white space char.
Newer servlet containers like Tomcat 7.x fix this problem, but it might
be a good idea to fix this issue within ARSnova.

See: https://www.owasp.org/index.php/HTTP_Response_Splitting

NovaEvents is derived from ApplicationEvent which extends EventObject.
EventObject implements Serializable.

It is bad practice if defined instance fields within NovaEvents
derived classes do not implement Serializable.

A boxed primitive is created from a String in
* RangeAspect#handlePaginationRange()
* LoginController#dialog()
just to extract the unboxed primitive value with Integer#valueOf().
This creates an Integer object. It is more efficient to use parseInt()
which creates a primitive int.

Corrected random indention in LoginController

In getSkillQuestion() a call to stubQuestions.get() contained an argument
with an incompatible class. Session will be converted into String using
toString() but this is not what was intended to do here.

In saveQuestion() the CouchDB document ID was used, but the sessions
keyword should have been used instead.

User object will be serialized into a String using toString() but this
should not be done in a unit test.

Interactive API documentation

Supersedes !5.

> This feature supports developers with an interactive documentation of
> the REST API from the ARSnova Backend.

Changes & Todos:
* Branch & code clean up
  * Rebase on master
  * Squash related commits authored by the same developer
  * Remove commits whose code has been reverted later on
  * Fix whitespaces
* Remove implementation notes (Java signatures are not helpful)
* Improve documentation of responses (Tom Käsler)
  * Do not define status messages for methods individually (DRY)
* Create JSON at compile-time by using
  [swagger-maven-plugin](https://github.com/kongchen/swagger-maven-plugin) (Tom Käsler)

See merge request !10

remove swagger annotation from feedbackcontroller, coursecontroller and getter and setter for sortOrder

add swagger maven plugin configuration

remove spingfox for ApiIgnore direction
use swagger-maven-plugin to generate swagger.json before compiling rather than
 dynamically generate it on request

Daniel Gerhardt authored 9 years ago and Tom Käsler committed 9 years ago

Reasons:
* not used consistently
* Java signatures are not helpful
* Return type should not be hard-coded in a String

Statistics model now correctly uses value instead of notes for
documentation of properties.

Daniel Gerhardt authored 9 years ago and Tom Käsler committed 9 years ago

* Fix inconsistent whitespaces
* Remove unused imports

Tjark Wilhelm Hoeck authored 9 years ago and Tom Käsler committed 9 years ago

added labeled deprecated rest endpoints to api documentation, commentet and included the feedbackController

Tjark Wilhelm Hoeck authored 9 years ago and Tom Käsler committed 9 years ago

Edited tests to support the new EnableWebMvc Annotation from the ExtraConfig file. No more test errors.

The config parameter is now used instead of the hard-coded value '5'.