[jira] [Resolved] (WICKET-4107) StatelessForm resubmitting via GET

["Martin Grigorov (Resolved) (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WICKET-4107?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Martin Grigorov resolved WICKET-4107.
-------------------------------------

    Resolution: Invalid
      Assignee: Martin Grigorov  (was: Johan Compagner)

Your problem is that the StatelessForm uses POST by default.
If you override its
        @Override
	protected String getMethod()
	{
		return Form.METHOD_GET;
	}

then the generated URL is: 
http://localhost:8080/stateless/foo?id1_hf_0=&0-1.IFormSubmitListener-statelessform=&textfield=10
and you can hit it as many times as you want.
                
> StatelessForm resubmitting via GET
> ----------------------------------
>
>                 Key: WICKET-4107
>                 URL: https://issues.apache.org/jira/browse/WICKET-4107
>             Project: Wicket
>          Issue Type: Bug
>          Components: wicket
>    Affects Versions: 1.4.18, 1.5.0, 1.5.1
>            Reporter: Chris Hansen
>            Assignee: Martin Grigorov
>
> After a StatelessForm is submitted, the user is redirected to a new URI. If  the user does an HTTP GET to this same URI, the form is resubmitted with all blank values (see examples below). This seems to happen regardless of the RenderStrategy being used or the form's method (i.e. POST), and it happens in recent versions of 1.4.x as well as 1.5.x.
> To demonstrate the behavior, visit either of the following links. The validation failure indicates that the form has been submitted just by visiting the URI (i.e. HTTP GET).
> http://wicketstuff.org/wicket14/stateless/?wicket:bookmarkablePage=:org.apache.wicket.examples.stateless.StatelessPage&wicket:interface=:0:statelessform::IFormSubmitListener::
> http://wicketstuff.org/wicket/stateless/foo?0-1.IFormSubmitListener-statelessform
> This behavior could be triggered when:
> * a user submits a StatelessForm and saves a bookmark to the generated URI.
> * a user submits a StatelessForm and shares a link to the generated URI via email or other means.
> * a user submits a StatelessForm, lets their session expire, then takes any action requiring login when using wicket-auth-roles. (They are redirected back to the generated URI after login.)
> * after submitting a StatelessForm, a user clicks in their address bar and hits enter.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira