WW-5765 Re-store only the token validated in the request in execAndWait

[lukaszlenart]

Fixes WW-5765

Problem

ExecuteAndWaitInterceptor puts a transaction token back into the session every time it returns the wait result, so that an action combining token and execAndWait keeps accepting its wait-page refreshes after TokenInterceptor has consumed the token (WW-1741). It took the value from the token request parameter and the name from struts.token.name, and did so whether or not a token had been validated in the current request, including for execAndWait actions with no token check, such as one using executeAndWaitStack. The value and the name were also read under different names.

Approach

• TokenHelper.validToken() records the token name and value it accepted in the current ActionContext.
• The new TokenHelper.restoreValidatedToken() puts exactly that pair back into the session, and does nothing when no token was validated in the current request.
• ExecuteAndWaitInterceptor calls it instead of reading request parameters.

Behaviour change

A token is now re-stored only if it went through TokenHelper.validToken() earlier in the same request. Setups where that never happened, such as a token interceptor ordered after execAndWait or custom token checking that bypasses TokenHelper, no longer get a token re-stored on the wait result. Worth a line in the migration notes.

Tests

• ExecuteAndWaitInterceptorTest
  • an execAndWait action without a token interceptor returns wait and leaves the session token store unchanged, for the default and a custom token name; this fails on the previous code;
  • token + execAndWait and tokenSession + execAndWait keep accepting the wait-page refresh that carries the validated token, then consume it on completion.
• TokenHelperTest: the validated token is restored; a rejected or unvalidated token leaves the session unchanged.
• ./mvnw -pl core test: 2739 tests, 0 failures, 0 errors.

Port of #2022 to the 6.x line; the only difference is the test imports (com.opensymphony.xwork2).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud