[FIXED JENKINS-12875] Change default crumb name to Jenkins-Crumb

core/src/main/java/hudson/security/csrf/CrumbFilter.java

@@ -62,17 +62,11 @@ public class CrumbFilter implements Filter {
             String crumbFieldName = crumbIssuer.getDescriptor().getCrumbRequestField();
             String crumbSalt = crumbIssuer.getDescriptor().getCrumbSalt();
 
-            String crumb = httpRequest.getHeader(crumbFieldName);
             boolean valid = false;
+            String crumb = extractCrumbFromRequest(httpRequest, crumbFieldName);
             if (crumb == null) {
-                Enumeration<?> paramNames = request.getParameterNames();
-                while (paramNames.hasMoreElements()) {
-                    String paramName = (String) paramNames.nextElement();
-                    if (crumbFieldName.equals(paramName)) {
-                        crumb = request.getParameter(paramName);
-                        break;
-                    }
-                }
+                // compatibility for clients that hard-code the default crumb name up to Jenkins 1.TODO
+                extractCrumbFromRequest(httpRequest, ".crumb");
             }
             if (crumb != null) {
                 if (crumbIssuer.validateCrumb(httpRequest, crumbSalt, crumb)) {
@@ -93,6 +87,21 @@ public class CrumbFilter implements Filter {
         }
     }
 
+    private String extractCrumbFromRequest(HttpServletRequest httpRequest, String crumbFieldName) {
+        String crumb = httpRequest.getHeader(crumbFieldName);
+        if (crumb == null) {
+            Enumeration<?> paramNames = httpRequest.getParameterNames();
+            while (paramNames.hasMoreElements()) {
+                String paramName = (String) paramNames.nextElement();
+                if (crumbFieldName.equals(paramName)) {
+                    crumb = httpRequest.getParameter(paramName);
+                    break;
+                }
+            }
+        }
+        return crumb;
+    }
+
     protected static boolean isMultipart(HttpServletRequest request) {
         if (request == null) {
             return false;

core/src/main/java/hudson/security/csrf/CrumbIssuer.java

@@ -43,6 +43,7 @@ import org.kohsuke.stapler.StaplerResponse;
 public abstract class CrumbIssuer implements Describable<CrumbIssuer>, ExtensionPoint {
 
     private static final String CRUMB_ATTRIBUTE = CrumbIssuer.class.getName() + "_crumb";
+    public static final String DEFAULT_CRUMB_NAME = "Jenkins-Crumb";
 
     /**
      * Get the name of the request parameter the crumb will be stored in. Exposed
@@ -199,7 +200,7 @@ public abstract class CrumbIssuer implements Describable<CrumbIssuer>, Extension
             } else if ("concat(//crumbRequestField,\":\",//crumb)".equals(xpath)) { // new FullDuplexHttpStream; Main
                 text = ci.getCrumbRequestField() + ':' + ci.getCrumb();
             } else if ("concat(//crumbRequestField,'=',//crumb)".equals(xpath)) { // NetBeans
-                if (ci.getCrumbRequestField().startsWith(".")) {
+                if (ci.getCrumbRequestField().startsWith(".") || ci.getCrumbRequestField().contains("-")) {
                     text = ci.getCrumbRequestField() + '=' + ci.getCrumb();
                 } else {
                     text = null;

core/src/main/java/hudson/security/csrf/CrumbIssuerDescriptor.java

@@ -64,7 +64,7 @@ public abstract class CrumbIssuerDescriptor<T extends CrumbIssuer> extends Descr
      */
     public void setCrumbRequestField(String requestField) {
         if (Util.fixEmptyAndTrim(requestField) == null) {
-            crumbRequestField = ".crumb";
+            crumbRequestField = CrumbIssuer.DEFAULT_CRUMB_NAME;
         } else {
             crumbRequestField = requestField;
         }

core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java

@@ -124,7 +124,7 @@ public class DefaultCrumbIssuer extends CrumbIssuer {
         private final static HexStringConfidentialKey CRUMB_SALT = new HexStringConfidentialKey(Jenkins.class,"crumbSalt",16);
         
         public DescriptorImpl() {
-            super(CRUMB_SALT.get(), System.getProperty("hudson.security.csrf.requestfield", ".crumb"));
+            super(CRUMB_SALT.get(), System.getProperty("hudson.security.csrf.requestfield", CrumbIssuer.DEFAULT_CRUMB_NAME));
             load();
         }
 

test/src/test/groovy/hudson/model/SlaveTest.groovy

@@ -28,6 +28,7 @@ import static hudson.util.FormValidation.Kind.WARNING
 import static org.junit.Assert.assertNotNull
 import static org.junit.Assert.assertEquals
 
+import hudson.security.csrf.CrumbIssuer
 import hudson.slaves.DumbSlave
 import hudson.slaves.JNLPLauncher
 import hudson.util.FormValidation
@@ -84,7 +85,7 @@ class SlaveTest {
         HttpURLConnection con = new URL(j.getURL(),url).openConnection();
         con.requestMethod = "POST"
         con.setRequestProperty("Content-Type","application/xml;charset=UTF-8")
-        con.setRequestProperty(".crumb","test")
+        con.setRequestProperty(CrumbIssuer.DEFAULT_CRUMB_NAME,"test")
         con.doOutput = true;
         con.outputStream.write(xml.getBytes("UTF-8"))
         con.outputStream.close();