diff --git a/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge3/Challenge3.java b/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge3/Challenge3.java index d5f94e774..d1a92dd84 100644 --- a/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge3/Challenge3.java +++ b/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/challenge3/Challenge3.java @@ -50,8 +50,8 @@ public class Challenge3 extends AssignmentEndpoint { @RequestMapping(method = POST, consumes = ALL_VALUE, produces = APPLICATION_JSON_VALUE) @ResponseBody - public AttackResult createNewUser(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception { - Comment comment = new Comment(); + public AttackResult createNewComment(@RequestBody String commentStr, @RequestHeader("Content-Type") String contentType) throws Exception { + Comment comment = null; AttackResult attackResult = failed().build(); if (APPLICATION_JSON_VALUE.equals(contentType)) { comment = parseJson(commentStr); @@ -63,10 +63,13 @@ public class Challenge3 extends AssignmentEndpoint { comment.setDateTime(DateTime.now().toString()); comment.setUser(webSession.getUserName()); } - - if (checkSolution(comment)) { - attackResult = success().feedback("challenge.solved").feedbackArgs(Flag.FLAGS.get(2)).build(); + if (comment != null) { + comments.add(comment); + if (checkSolution(comment)) { + attackResult = success().feedback("challenge.solved").feedbackArgs(Flag.FLAGS.get(2)).build(); + } } + return attackResult; } diff --git a/webgoat-lessons/challenge/src/main/resources/html/Challenge.html b/webgoat-lessons/challenge/src/main/resources/html/Challenge.html index c909915bf..0d0b0fe86 100644 --- a/webgoat-lessons/challenge/src/main/resources/html/Challenge.html +++ b/webgoat-lessons/challenge/src/main/resources/html/Challenge.html @@ -195,49 +195,6 @@
COMMENT
' + + '
John dOE
-7 minutes ago
-I really love this picture. I really wish i could have been - there.
-John Doe
-3 minutes ago
-I think I might you this for one of my projects.
-John Doe
-10 seconds ago
-Wow! This is gorgeous.
-