LPS-40946 Portlets with invalid id should not be processed at all
LPS-39735 Check portlet configuration permission before creating portlet preferences
LPS-40975 SF
LPS-35935 Context sensitive CSRF checking - portal-service no change
LPS-35935 Context sensitive CSRF checking - impl
LPS-35935 Context sensitive CSRF checking - update usages
LPS-35935 CSRF context whitelist preparation - no change
LPS-35935 CSRF context whitelist implementation
LPS-35935 CSRF context whitelist hook support
LPS-35935 Extend CSRF context whitelist sensitivity for JSON API
LPS-35935 SF
LPS-35935 Rename CSRF context to CSRF origin
LPS-35935 SF
LPS-35935 Compare this to JSONWebServiceServiceAction#getCSRFOrigin, one has :/ the other has : without the / which makes me think that both should have :/ because that's how it is in portal.properties.
LPS-35935 Add @see to make it obvious
LPS-35935 SF
LPS-35935 I renamed it to just isValidSharedSecret because the var name was sometimes used as csrfSharedSecret and sometimes as sharedSecret, so I wanted to make it consistent. I chose shared secret insteda of renaming everything to csrf shared secret because the portal.properties for the shared secret didn't mention anything about csrf.
LPS-35935 Match isPortletCSRFWhitelisted
LPS-35935 Avoid "please use", otherwise, we'd have to add it everywhere to be consistently polite. Let's just stick to facts.
LPS-35935 Consistently use @deprecated as a comment. We'll one day convert all of them to the @Deprecated annotation, but the javadoc formatter expects it to be a comment for now.