From 4d3126085524ed91b40a6a26214252ca76d82c0e Mon Sep 17 00:00:00 2001 From: Sandra <229708855+SandraNelj@users.noreply.github.com> Date: Wed, 8 Apr 2026 13:13:08 +0200 Subject: [PATCH 1/5] Refactor incident creation flow and dashboard links - createincident.html: Added th:action to form, removed entire script section. - dashboard.html: Updated "Create new incident" link to /create-incident. - IncidentController.java: Added @AuthenticationPrincipal CustomUserDetails to controller methods. - IncidentService.java: Replaced unused userDetails with AppUser user in method parameters. - PageController.java: - Injected IncidentService. - Added switch-case on user.getRole() to fetch incidents based on role. - Added CsrfToken to model for forms. - Added POST endpoint for submitting new incidents. - Added GET endpoint to view a created incident. --- .../controller/IncidentController.java | 26 ++++-- .../incident/service/IncidentService.java | 16 ++-- .../team6backend/page/PageController.java | 79 ++++++++++++++++--- .../resources/templates/createincident.html | 48 +++-------- src/main/resources/templates/dashboard.html | 2 +- 5 files changed, 106 insertions(+), 65 deletions(-) diff --git a/src/main/java/org/example/team6backend/incident/controller/IncidentController.java b/src/main/java/org/example/team6backend/incident/controller/IncidentController.java index d995f1f..536f285 100644 --- a/src/main/java/org/example/team6backend/incident/controller/IncidentController.java +++ b/src/main/java/org/example/team6backend/incident/controller/IncidentController.java @@ -5,9 +5,12 @@ import org.example.team6backend.incident.dto.IncidentResponse; import org.example.team6backend.incident.entity.Incident; import org.example.team6backend.incident.service.IncidentService; +import org.example.team6backend.security.CustomUserDetails; +import org.example.team6backend.user.entity.AppUser; import org.springframework.data.domain.Page; import org.springframework.data.domain.Pageable; import org.springframework.security.access.prepost.PreAuthorize; +import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.web.bind.annotation.*; @RestController @@ -23,32 +26,41 @@ public IncidentController(IncidentService incidentService) { /** Create new incident */ @PostMapping @PreAuthorize("hasAnyRole('RESIDENT', 'ADMIN')") - public IncidentResponse createIncident(@Valid @RequestBody IncidentRequest incidentRequest) { + public IncidentResponse createIncident(@RequestBody @Valid IncidentRequest incidentRequest) { Incident incident = new Incident(); incident.setSubject(incidentRequest.getSubject()); incident.setDescription(incidentRequest.getDescription()); incident.setIncidentCategory(incidentRequest.getIncidentCategory()); - Incident saved = incidentService.createIncident(incident); + Incident saved = incidentService.createIncident(incident); return IncidentResponse.fromEntity(saved); } /** Get my incidents(user) */ @PreAuthorize("hasRole('RESIDENT')") @GetMapping("/my") - public Page getMyIncidents(Pageable pageable) { - return incidentService.findByCreatedBy(pageable).map(IncidentResponse::fromEntity); + public Page getMyIncidents( + @AuthenticationPrincipal CustomUserDetails userDetails, Pageable pageable) { + + AppUser user = userDetails.getUser(); + return incidentService.findByCreatedBy(user, pageable) + .map(IncidentResponse::fromEntity); } + /** Get assigned incidents(handler) */ @PreAuthorize("hasRole('HANDLER')") @GetMapping("/assigned") - public Page getAssignedIncidents(Pageable pageable) { - return incidentService.findByAssignedTo(pageable).map(IncidentResponse::fromEntity); + public Page getAssignedIncidents( + @AuthenticationPrincipal CustomUserDetails userDetails, Pageable pageable) { + AppUser user = userDetails.getUser(); + return incidentService.findByAssignedTo(user, pageable) + .map(IncidentResponse::fromEntity); } @PreAuthorize("hasRole('ADMIN')") @GetMapping("/all") public Page getAllIncidents(Pageable pageable) { - return incidentService.findAll(pageable).map(IncidentResponse::fromEntity); + return incidentService.findAll(pageable) + .map(IncidentResponse::fromEntity); } } diff --git a/src/main/java/org/example/team6backend/incident/service/IncidentService.java b/src/main/java/org/example/team6backend/incident/service/IncidentService.java index ae43b1e..f773ef4 100644 --- a/src/main/java/org/example/team6backend/incident/service/IncidentService.java +++ b/src/main/java/org/example/team6backend/incident/service/IncidentService.java @@ -52,20 +52,16 @@ public Page findAll(Pageable pageable) { } /** Find your own incidents (user) **/ - public Page findByCreatedBy(Pageable pageable) { - Authentication auth = SecurityContextHolder.getContext().getAuthentication(); - CustomUserDetails userDetails = (CustomUserDetails) auth.getPrincipal(); - AppUser user = userDetails.getUser(); - + public Page findByCreatedBy(AppUser user, Pageable pageable) { return incidentRepository.findByCreatedBy(user, withDefaultSort(pageable)); } /** Find assigned incidents per HANDLER **/ - public Page findByAssignedTo(Pageable pageable) { - Authentication auth = SecurityContextHolder.getContext().getAuthentication(); - CustomUserDetails userDetails = (CustomUserDetails) auth.getPrincipal(); - AppUser user = userDetails.getUser(); - + public Page findByAssignedTo(AppUser user, Pageable pageable) { return incidentRepository.findByAssignedTo(user, withDefaultSort(pageable)); } + + public Incident findById(Long id) { + return incidentRepository.findById(id).orElse(null); + } } diff --git a/src/main/java/org/example/team6backend/page/PageController.java b/src/main/java/org/example/team6backend/page/PageController.java index 66a8266..143863e 100644 --- a/src/main/java/org/example/team6backend/page/PageController.java +++ b/src/main/java/org/example/team6backend/page/PageController.java @@ -1,20 +1,29 @@ package org.example.team6backend.page; +import org.example.team6backend.incident.dto.IncidentRequest; +import org.example.team6backend.incident.entity.Incident; +import org.example.team6backend.incident.service.IncidentService; import org.example.team6backend.security.CustomUserDetails; import org.example.team6backend.user.entity.AppUser; import org.example.team6backend.user.service.UserService; +import jakarta.servlet.http.HttpServletRequest; +import org.springframework.data.domain.Page; +import org.springframework.data.domain.Pageable; import org.springframework.security.core.annotation.AuthenticationPrincipal; +import org.springframework.security.web.csrf.CsrfToken; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; -import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.*; @Controller public class PageController { private final UserService userService; + private final IncidentService incidentService; - public PageController(UserService userService) { + public PageController(UserService userService, IncidentService incidentService) { this.userService = userService; - } + this.incidentService = incidentService; + } @GetMapping("/") public String index() { @@ -22,10 +31,27 @@ public String index() { } @GetMapping("/dashboard") - public String dashboard(@AuthenticationPrincipal CustomUserDetails userDetails, Model model) { - AppUser user = userDetails.getUser(); - model.addAttribute("user", user); - model.addAttribute("role", user.getRole().name()); + public String dashboard(@AuthenticationPrincipal CustomUserDetails userDetails, + Model model, Pageable pageable) { + + if (userDetails != null && userDetails.getUser() != null) { + AppUser user = userDetails.getUser(); + model.addAttribute("user", userDetails.getUser()); + model.addAttribute("role", user.getRole().name()); + + Page incidents; + + switch (user.getRole()) { + case RESIDENT -> incidents = incidentService.findByCreatedBy(user, pageable); + case HANDLER -> incidents = incidentService.findByAssignedTo(user, pageable); + case ADMIN -> incidents = incidentService.findAll(pageable); + default -> incidents = Page.empty(); + } + model.addAttribute("incidents", incidents); + + } else { + model.addAttribute("role", "PENDING"); + } return "dashboard"; } @@ -36,18 +62,53 @@ public String incidents(@AuthenticationPrincipal CustomUserDetails userDetails, } @GetMapping("/create-incident") - public String createIncident(@AuthenticationPrincipal CustomUserDetails userDetails, Model model) { + public String createIncident(@AuthenticationPrincipal CustomUserDetails userDetails, Model model, + HttpServletRequest request) { AppUser user = userDetails.getUser(); - String role = user.getRole().name(); + + CsrfToken csrf = (CsrfToken) request.getAttribute("_csrf"); + model.addAttribute("_csrf", csrf); + if (role.equals("RESIDENT") || role.equals("ADMIN")) { model.addAttribute("role", role); model.addAttribute("user", user); + model.addAttribute("incidentRequest", new IncidentRequest()); return "createincident"; } return "redirect:/dashboard"; } + @PostMapping("/create-incident") + public String submitIncident(@AuthenticationPrincipal CustomUserDetails userDetails, + @ModelAttribute IncidentRequest incidentRequest, Model model) { + AppUser user = userDetails.getUser(); + String role = user.getRole().name(); + + Incident incident = new Incident(); + incident.setSubject(incidentRequest.getSubject()); + incident.setDescription(incidentRequest.getDescription()); + incident.setIncidentCategory(incidentRequest.getIncidentCategory()); + incident.setCreatedBy(user); + + Incident saved = incidentService.createIncident(incident); + + model.addAttribute("success", "Incident created successfully!"); + model.addAttribute("incidentRequest", incidentRequest); + return "redirect:/incident/" + saved.getId(); + } + + @GetMapping("/incident/{id}") + public String viewIncident(@PathVariable Long id, Model model) { + Incident incident = incidentService.findById(id); + + if (incident == null) { + return "redirect:/dashboard"; + } + model.addAttribute("incident", incident); + return "view-incident"; + } + @GetMapping("/profile") public String profile(@AuthenticationPrincipal CustomUserDetails userDetails, Model model) { AppUser user = userDetails.getUser(); diff --git a/src/main/resources/templates/createincident.html b/src/main/resources/templates/createincident.html index c3ff473..1d6e79b 100644 --- a/src/main/resources/templates/createincident.html +++ b/src/main/resources/templates/createincident.html @@ -68,16 +68,17 @@

Report Incident

-
+ + - - + + - - + + - - @@ -86,38 +87,9 @@

Report Incident

+
+
- - \ No newline at end of file diff --git a/src/main/resources/templates/dashboard.html b/src/main/resources/templates/dashboard.html index b324942..a668238 100644 --- a/src/main/resources/templates/dashboard.html +++ b/src/main/resources/templates/dashboard.html @@ -424,7 +424,7 @@

Recent incidents

Loading incidents...

From 782bc6a6895f00e80b684e83982ecc22008ebeb6 Mon Sep 17 00:00:00 2001 From: Sandra <229708855+SandraNelj@users.noreply.github.com> Date: Wed, 8 Apr 2026 13:36:52 +0200 Subject: [PATCH 2/5] Run mvn spotless:apply --- .../controller/IncidentController.java | 25 ++-- .../incident/service/IncidentService.java | 6 +- .../team6backend/page/PageController.java | 115 +++++++++--------- 3 files changed, 71 insertions(+), 75 deletions(-) diff --git a/src/main/java/org/example/team6backend/incident/controller/IncidentController.java b/src/main/java/org/example/team6backend/incident/controller/IncidentController.java index 536f285..e130044 100644 --- a/src/main/java/org/example/team6backend/incident/controller/IncidentController.java +++ b/src/main/java/org/example/team6backend/incident/controller/IncidentController.java @@ -32,35 +32,32 @@ public IncidentResponse createIncident(@RequestBody @Valid IncidentRequest incid incident.setDescription(incidentRequest.getDescription()); incident.setIncidentCategory(incidentRequest.getIncidentCategory()); - Incident saved = incidentService.createIncident(incident); + Incident saved = incidentService.createIncident(incident); return IncidentResponse.fromEntity(saved); } /** Get my incidents(user) */ @PreAuthorize("hasRole('RESIDENT')") @GetMapping("/my") - public Page getMyIncidents( - @AuthenticationPrincipal CustomUserDetails userDetails, Pageable pageable) { + public Page getMyIncidents(@AuthenticationPrincipal CustomUserDetails userDetails, + Pageable pageable) { - AppUser user = userDetails.getUser(); - return incidentService.findByCreatedBy(user, pageable) - .map(IncidentResponse::fromEntity); + AppUser user = userDetails.getUser(); + return incidentService.findByCreatedBy(user, pageable).map(IncidentResponse::fromEntity); } - /** Get assigned incidents(handler) */ + /** Get assigned incidents(handler) */ @PreAuthorize("hasRole('HANDLER')") @GetMapping("/assigned") - public Page getAssignedIncidents( - @AuthenticationPrincipal CustomUserDetails userDetails, Pageable pageable) { - AppUser user = userDetails.getUser(); - return incidentService.findByAssignedTo(user, pageable) - .map(IncidentResponse::fromEntity); + public Page getAssignedIncidents(@AuthenticationPrincipal CustomUserDetails userDetails, + Pageable pageable) { + AppUser user = userDetails.getUser(); + return incidentService.findByAssignedTo(user, pageable).map(IncidentResponse::fromEntity); } @PreAuthorize("hasRole('ADMIN')") @GetMapping("/all") public Page getAllIncidents(Pageable pageable) { - return incidentService.findAll(pageable) - .map(IncidentResponse::fromEntity); + return incidentService.findAll(pageable).map(IncidentResponse::fromEntity); } } diff --git a/src/main/java/org/example/team6backend/incident/service/IncidentService.java b/src/main/java/org/example/team6backend/incident/service/IncidentService.java index f773ef4..4de52e4 100644 --- a/src/main/java/org/example/team6backend/incident/service/IncidentService.java +++ b/src/main/java/org/example/team6backend/incident/service/IncidentService.java @@ -61,7 +61,7 @@ public Page findByAssignedTo(AppUser user, Pageable pageable) { return incidentRepository.findByAssignedTo(user, withDefaultSort(pageable)); } - public Incident findById(Long id) { - return incidentRepository.findById(id).orElse(null); - } + public Incident findById(Long id) { + return incidentRepository.findById(id).orElse(null); + } } diff --git a/src/main/java/org/example/team6backend/page/PageController.java b/src/main/java/org/example/team6backend/page/PageController.java index 143863e..b0e1b4d 100644 --- a/src/main/java/org/example/team6backend/page/PageController.java +++ b/src/main/java/org/example/team6backend/page/PageController.java @@ -18,12 +18,12 @@ @Controller public class PageController { private final UserService userService; - private final IncidentService incidentService; + private final IncidentService incidentService; - public PageController(UserService userService, IncidentService incidentService) { + public PageController(UserService userService, IncidentService incidentService) { this.userService = userService; - this.incidentService = incidentService; - } + this.incidentService = incidentService; + } @GetMapping("/") public String index() { @@ -31,27 +31,26 @@ public String index() { } @GetMapping("/dashboard") - public String dashboard(@AuthenticationPrincipal CustomUserDetails userDetails, - Model model, Pageable pageable) { - - if (userDetails != null && userDetails.getUser() != null) { - AppUser user = userDetails.getUser(); - model.addAttribute("user", userDetails.getUser()); - model.addAttribute("role", user.getRole().name()); - - Page incidents; - - switch (user.getRole()) { - case RESIDENT -> incidents = incidentService.findByCreatedBy(user, pageable); - case HANDLER -> incidents = incidentService.findByAssignedTo(user, pageable); - case ADMIN -> incidents = incidentService.findAll(pageable); - default -> incidents = Page.empty(); - } - model.addAttribute("incidents", incidents); - - } else { - model.addAttribute("role", "PENDING"); - } + public String dashboard(@AuthenticationPrincipal CustomUserDetails userDetails, Model model, Pageable pageable) { + + if (userDetails != null && userDetails.getUser() != null) { + AppUser user = userDetails.getUser(); + model.addAttribute("user", userDetails.getUser()); + model.addAttribute("role", user.getRole().name()); + + Page incidents; + + switch (user.getRole()) { + case RESIDENT -> incidents = incidentService.findByCreatedBy(user, pageable); + case HANDLER -> incidents = incidentService.findByAssignedTo(user, pageable); + case ADMIN -> incidents = incidentService.findAll(pageable); + default -> incidents = Page.empty(); + } + model.addAttribute("incidents", incidents); + + } else { + model.addAttribute("role", "PENDING"); + } return "dashboard"; } @@ -63,51 +62,51 @@ public String incidents(@AuthenticationPrincipal CustomUserDetails userDetails, @GetMapping("/create-incident") public String createIncident(@AuthenticationPrincipal CustomUserDetails userDetails, Model model, - HttpServletRequest request) { + HttpServletRequest request) { AppUser user = userDetails.getUser(); String role = user.getRole().name(); - CsrfToken csrf = (CsrfToken) request.getAttribute("_csrf"); - model.addAttribute("_csrf", csrf); + CsrfToken csrf = (CsrfToken) request.getAttribute("_csrf"); + model.addAttribute("_csrf", csrf); if (role.equals("RESIDENT") || role.equals("ADMIN")) { model.addAttribute("role", role); model.addAttribute("user", user); - model.addAttribute("incidentRequest", new IncidentRequest()); + model.addAttribute("incidentRequest", new IncidentRequest()); return "createincident"; } return "redirect:/dashboard"; } - @PostMapping("/create-incident") - public String submitIncident(@AuthenticationPrincipal CustomUserDetails userDetails, - @ModelAttribute IncidentRequest incidentRequest, Model model) { - AppUser user = userDetails.getUser(); - String role = user.getRole().name(); - - Incident incident = new Incident(); - incident.setSubject(incidentRequest.getSubject()); - incident.setDescription(incidentRequest.getDescription()); - incident.setIncidentCategory(incidentRequest.getIncidentCategory()); - incident.setCreatedBy(user); - - Incident saved = incidentService.createIncident(incident); - - model.addAttribute("success", "Incident created successfully!"); - model.addAttribute("incidentRequest", incidentRequest); - return "redirect:/incident/" + saved.getId(); - } - - @GetMapping("/incident/{id}") - public String viewIncident(@PathVariable Long id, Model model) { - Incident incident = incidentService.findById(id); - - if (incident == null) { - return "redirect:/dashboard"; - } - model.addAttribute("incident", incident); - return "view-incident"; - } + @PostMapping("/create-incident") + public String submitIncident(@AuthenticationPrincipal CustomUserDetails userDetails, + @ModelAttribute IncidentRequest incidentRequest, Model model) { + AppUser user = userDetails.getUser(); + String role = user.getRole().name(); + + Incident incident = new Incident(); + incident.setSubject(incidentRequest.getSubject()); + incident.setDescription(incidentRequest.getDescription()); + incident.setIncidentCategory(incidentRequest.getIncidentCategory()); + incident.setCreatedBy(user); + + Incident saved = incidentService.createIncident(incident); + + model.addAttribute("success", "Incident created successfully!"); + model.addAttribute("incidentRequest", incidentRequest); + return "redirect:/incident/" + saved.getId(); + } + + @GetMapping("/incident/{id}") + public String viewIncident(@PathVariable Long id, Model model) { + Incident incident = incidentService.findById(id); + + if (incident == null) { + return "redirect:/dashboard"; + } + model.addAttribute("incident", incident); + return "view-incident"; + } @GetMapping("/profile") public String profile(@AuthenticationPrincipal CustomUserDetails userDetails, Model model) { From a1348f1aba08e97c7c965f4becb37f3d5acee9cc Mon Sep 17 00:00:00 2001 From: Sandra <229708855+SandraNelj@users.noreply.github.com> Date: Wed, 8 Apr 2026 14:42:52 +0200 Subject: [PATCH 3/5] fix: secure /incident/{id} endpoint with authorization checks - restrict access to ADMIN, assigned HANDLER, or owning RESIDENT - return 403 Forbidden for unauthorized access - fix role comparison using enum instead of string --- .../team6backend/page/PageController.java | 31 +++++++++++++++++-- .../resources/templates/createincident.html | 28 +++++++++++++++-- 2 files changed, 54 insertions(+), 5 deletions(-) diff --git a/src/main/java/org/example/team6backend/page/PageController.java b/src/main/java/org/example/team6backend/page/PageController.java index b0e1b4d..dbe9cb6 100644 --- a/src/main/java/org/example/team6backend/page/PageController.java +++ b/src/main/java/org/example/team6backend/page/PageController.java @@ -1,5 +1,6 @@ package org.example.team6backend.page; +import jakarta.validation.Valid; import org.example.team6backend.incident.dto.IncidentRequest; import org.example.team6backend.incident.entity.Incident; import org.example.team6backend.incident.service.IncidentService; @@ -9,11 +10,15 @@ import jakarta.servlet.http.HttpServletRequest; import org.springframework.data.domain.Page; import org.springframework.data.domain.Pageable; +import org.springframework.http.HttpStatus; +import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.security.web.csrf.CsrfToken; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; +import org.springframework.validation.BindingResult; import org.springframework.web.bind.annotation.*; +import org.springframework.web.server.ResponseStatusException; @Controller public class PageController { @@ -78,12 +83,19 @@ public String createIncident(@AuthenticationPrincipal CustomUserDetails userDeta return "redirect:/dashboard"; } + @PreAuthorize("hasAnyRole('RESIDENT', 'ADMIN')") @PostMapping("/create-incident") public String submitIncident(@AuthenticationPrincipal CustomUserDetails userDetails, - @ModelAttribute IncidentRequest incidentRequest, Model model) { + @Valid @ModelAttribute IncidentRequest incidentRequest, BindingResult bindingResult, Model model) { AppUser user = userDetails.getUser(); String role = user.getRole().name(); + if (bindingResult.hasErrors()) { + model.addAttribute("role", role); + model.addAttribute("user", user); + return "createincident"; + } + Incident incident = new Incident(); incident.setSubject(incidentRequest.getSubject()); incident.setDescription(incidentRequest.getDescription()); @@ -98,12 +110,27 @@ public String submitIncident(@AuthenticationPrincipal CustomUserDetails userDeta } @GetMapping("/incident/{id}") - public String viewIncident(@PathVariable Long id, Model model) { + public String viewIncident(@PathVariable Long id, @AuthenticationPrincipal CustomUserDetails userDetails, + Model model) { + Incident incident = incidentService.findById(id); if (incident == null) { return "redirect:/dashboard"; } + + AppUser user = userDetails.getUser(); + + boolean isAdmin = user.getRole().name().equals("ADMIN"); + + boolean isHandler = incident.getAssignedTo() != null && incident.getAssignedTo().getId().equals(user.getId()); + + boolean isResident = incident.getCreatedBy().getId().equals(user.getId()); + + if (!isAdmin && !isHandler && !isResident) { + throw new ResponseStatusException(HttpStatus.FORBIDDEN); + } + model.addAttribute("incident", incident); return "view-incident"; } diff --git a/src/main/resources/templates/createincident.html b/src/main/resources/templates/createincident.html index 1d6e79b..55571b1 100644 --- a/src/main/resources/templates/createincident.html +++ b/src/main/resources/templates/createincident.html @@ -71,23 +71,45 @@

Report Incident

+ +
+ Please correct the errors below. +
+ + - + +
+
+ +
+
+ - + +
+
-
+ +
From 41c7d321970363466ab6b6520cef413a882baaf9 Mon Sep 17 00:00:00 2001 From: Sandra <229708855+SandraNelj@users.noreply.github.com> Date: Wed, 8 Apr 2026 15:01:04 +0200 Subject: [PATCH 4/5] fix: Add CSRF token to model on validation error to prevent form re-render failure. --- .../java/org/example/team6backend/page/PageController.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/main/java/org/example/team6backend/page/PageController.java b/src/main/java/org/example/team6backend/page/PageController.java index dbe9cb6..c46540d 100644 --- a/src/main/java/org/example/team6backend/page/PageController.java +++ b/src/main/java/org/example/team6backend/page/PageController.java @@ -86,13 +86,16 @@ public String createIncident(@AuthenticationPrincipal CustomUserDetails userDeta @PreAuthorize("hasAnyRole('RESIDENT', 'ADMIN')") @PostMapping("/create-incident") public String submitIncident(@AuthenticationPrincipal CustomUserDetails userDetails, - @Valid @ModelAttribute IncidentRequest incidentRequest, BindingResult bindingResult, Model model) { + @Valid @ModelAttribute IncidentRequest incidentRequest, BindingResult bindingResult, Model model, + HttpServletRequest request) { AppUser user = userDetails.getUser(); String role = user.getRole().name(); if (bindingResult.hasErrors()) { model.addAttribute("role", role); model.addAttribute("user", user); + CsrfToken csrf = (CsrfToken) request.getAttribute("_csrf"); + model.addAttribute("_csrf", csrf); return "createincident"; } From 274eb5ad8c35b40754ec6e59d3d02568e58451f0 Mon Sep 17 00:00:00 2001 From: Sandra <229708855+SandraNelj@users.noreply.github.com> Date: Wed, 8 Apr 2026 15:02:20 +0200 Subject: [PATCH 5/5] Run mvn spotless --- .../java/org/example/team6backend/page/PageController.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/main/java/org/example/team6backend/page/PageController.java b/src/main/java/org/example/team6backend/page/PageController.java index c46540d..5b3521f 100644 --- a/src/main/java/org/example/team6backend/page/PageController.java +++ b/src/main/java/org/example/team6backend/page/PageController.java @@ -87,15 +87,15 @@ public String createIncident(@AuthenticationPrincipal CustomUserDetails userDeta @PostMapping("/create-incident") public String submitIncident(@AuthenticationPrincipal CustomUserDetails userDetails, @Valid @ModelAttribute IncidentRequest incidentRequest, BindingResult bindingResult, Model model, - HttpServletRequest request) { + HttpServletRequest request) { AppUser user = userDetails.getUser(); String role = user.getRole().name(); if (bindingResult.hasErrors()) { model.addAttribute("role", role); model.addAttribute("user", user); - CsrfToken csrf = (CsrfToken) request.getAttribute("_csrf"); - model.addAttribute("_csrf", csrf); + CsrfToken csrf = (CsrfToken) request.getAttribute("_csrf"); + model.addAttribute("_csrf", csrf); return "createincident"; }