* Console:

- Convert GraphHelper to a FormHandler
      - Require POST for all forms
      - Change the way we store the Writer to prevent problems
      - Fix bonus setting on configpeer.jsp
      - More ".jsp" removal

apps/routerconsole/java/src/net/i2p/router/web/ConfigPeerHandler.java

@@ -36,7 +36,7 @@ public class ConfigPeerHandler extends FormHandler {
                 return;
             }
             addFormError(_("Invalid peer"));
-        } else if (_action.equals(_("Adjust Profile Bonuses"))) {
+        } else if (_action.equals(_("Adjust peer bonuses"))) {
             Hash h = getHash();
             if (h != null) {
                 PeerProfile prof = _context.profileOrganizer().getProfile(h);
@@ -59,6 +59,8 @@ public class ConfigPeerHandler extends FormHandler {
             addFormError(_("Invalid peer"));
         } else if (_action.startsWith("Check")) {
             addFormError(_("Unsupported"));
+        } else {
+            addFormError("Unknown action \"" + _action + '"');
         }
     }
     

apps/routerconsole/java/src/net/i2p/router/web/FormHandler.java

@@ -20,26 +20,23 @@ public class FormHandler {
     protected Log _log;
     private String _nonce;
     protected String _action;
+    protected String _method;
     protected String _passphrase;
-    private List<String> _errors;
-    private List<String> _notices;
+    private final List<String> _errors;
+    private final List<String> _notices;
     private boolean _processed;
     private boolean _valid;
     
     public FormHandler() {
         _errors = new ArrayList();
         _notices = new ArrayList();
-        _action = null;
-        _processed = false;
         _valid = true;
-        _nonce = null;
-        _passphrase = null;
     }
     
     /**
      * Configure this bean to query a particular router context
      *
-     * @param contextId begging few characters of the routerHash, or null to pick
+     * @param contextId beginning few characters of the routerHash, or null to pick
      *                  the first one we come across.
      */
     public void setContextId(String contextId) {
@@ -54,6 +51,14 @@ public class FormHandler {
     public void setNonce(String val) { _nonce = val; }
     public void setAction(String val) { _action = val; }
     public void setPassphrase(String val) { _passphrase = val; }
+
+    /**
+     * Call this to prevent changes using GET
+     *
+     * @param the request method
+     * @since 0.8.2
+     */
+    public void storeMethod(String val) { _method = val; }
     
     /**
      * Override this to perform the final processing (in turn, adding formNotice
@@ -145,6 +150,12 @@ public class FormHandler {
             _valid = false;
             return;
         }
+        // To prevent actions with GET, jsps must call storeMethod()
+        if (_method != null && !"POST".equals(_method)) {
+            addFormError("Invalid form submission, requires POST not " + _method);
+            _valid = false;
+            return;
+        }
         
         String sharedNonce = System.getProperty("router.consoleNonce");
         if ( (sharedNonce != null) && (sharedNonce.equals(_nonce) ) ) {
@@ -211,4 +222,8 @@ public class FormHandler {
         return Messages.getString(s, o, _context);
     }
 
+    /** two params @since 0.8.2 */
+    public String _(String s, Object o, Object o2) {
+        return Messages.getString(s, o, o2, _context);
+    }
 }

apps/routerconsole/java/src/net/i2p/router/web/GraphHelper.java

@@ -1,6 +1,7 @@
 package net.i2p.router.web;
 
 import java.io.IOException;
+import java.io.Writer;
 import java.util.Comparator;
 import java.util.Iterator;
 import java.util.List;
@@ -9,7 +10,8 @@ import java.util.TreeSet;
 import net.i2p.data.DataHelper;
 import net.i2p.stat.Rate;
 
-public class GraphHelper extends HelperBase {
+public class GraphHelper extends FormHandler {
+    protected Writer _out;
     private int _periodCount;
     private boolean _showEvents;
     private int _width;
@@ -29,9 +31,6 @@ public class GraphHelper extends HelperBase {
     static final int MAX_Y = 1024;
     private static final int MIN_REFRESH = 15;
     
-    public GraphHelper() {
-    }
-
     /** set the defaults after we have a context */
     @Override
     public void setContextId(String contextId) {
@@ -43,6 +42,12 @@ public class GraphHelper extends HelperBase {
         _showEvents = Boolean.valueOf(_context.getProperty(PROP_EVENTS)).booleanValue();
     }
     
+    /**
+     *  This was a HelperBase but now it's a FormHandler
+     *  @since 0.8.2
+     */
+    public void storeWriter(Writer out) { _out = out; }
+
     public void setPeriodCount(String str) { 
         try { _periodCount = Integer.parseInt(str); } catch (NumberFormatException nfe) {}
     }
@@ -125,10 +130,15 @@ public class GraphHelper extends HelperBase {
     }
 
     public String getForm() { 
-        saveSettings();
+        String prev = System.getProperty("net.i2p.router.web.GraphHelper.nonce");
+        if (prev != null) System.setProperty("net.i2p.router.web.GraphHelper.noncePrev", prev);
+        String nonce = "" + _context.random().nextLong();
+        System.setProperty("net.i2p.router.web.GraphHelper.nonce", nonce);
         try {
             _out.write("<br><h3>" + _("Configure Graph Display") + " [<a href=\"configstats\">" + _("Select Stats") + "</a>]</h3>");
-            _out.write("<form action=\"graphs\" method=\"POST\">");
+            _out.write("<form action=\"graphs\" method=\"POST\">\n" +
+                       "<input type=\"hidden\" name=\"action\" value=\"foo\">\n" +
+                       "<input type=\"hidden\" name=\"nonce\" value=\"" + nonce + "\" >\n");
             _out.write(_("Periods") + ": <input size=\"3\" type=\"text\" name=\"periodCount\" value=\"" + _periodCount + "\"><br>\n");
             _out.write(_("Plot averages") + ": <input type=\"radio\" class=\"optbox\" name=\"showEvents\" value=\"false\" " + (_showEvents ? "" : "checked=\"true\" ") + "> ");
             _out.write(_("or")+ " " +_("plot events") + ": <input type=\"radio\" class=\"optbox\" name=\"showEvents\" value=\"true\" "+ (_showEvents ? "checked=\"true\" " : "") + "><br>\n");
@@ -143,6 +153,15 @@ public class GraphHelper extends HelperBase {
         return ""; 
     }
 
+    /**
+     *  This was a HelperBase but now it's a FormHandler
+     *  @since 0.8.2
+     */
+    @Override
+    protected void processForm() {
+        saveSettings();
+    }
+
     /**
      *  Silently save settings if changed, no indication of success or failure
      *  @since 0.7.10
@@ -159,6 +178,7 @@ public class GraphHelper extends HelperBase {
             _context.router().setConfigSetting(PROP_REFRESH, "" + _refreshDelaySeconds);
             _context.router().setConfigSetting(PROP_EVENTS, "" + _showEvents);
             _context.router().saveConfig();
+            addFormNotice(_("Graph settings saved"));
         }
     }
 

apps/routerconsole/java/src/net/i2p/router/web/HelperBase.java

@@ -28,7 +28,13 @@ public abstract class HelperBase {
     /** might be useful in the jsp's */
     //public RouterContext getContext() { return _context; }
 
-    public void setWriter(Writer out) { _out = out; }
+
+    /**
+     *  Renamed from setWriter, we realy don't want setFoo(non-String)
+     *  Prevent jsp.error.beans.property.conversion 500 error for ?writer=foo
+     *  @since 0.8.2
+     */
+    public void storeWriter(Writer out) { _out = out; }
 
     /** translate a string */
     public String _(String s) {