[TAPESTRY-2547] Field validation is bypassed if form action url is used as a GET url

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 5.0.13
• Component/s: tapestry-core
• Assignee: Howard Lewis Ship
• Reporter: Francois Armand
• Created: 01/Aug/08 09:22
• Updated: 08/Sep/08 20:26
• Resolved: 08/Aug/08 15:46

Description

We have a form, the simpliest one is ok, say this one on "TestPage" page :
<t:form>
<t:textfield t:id="field" t:validate="required" t:value="value" />
<t:submit/>
</t:form>

This form is supposed to required a a non empty value for value.
All goes fine if we click on ok, but if a twisted tester try to enter directly the action url in the browser ( t5app/testpage.form), the field level validation are bypassed (but all form events are throws and so the one done in "onValidateFormFrom" arecorrectly performed).

The result is that the form may be successful with inconsistent data, in our case a null value.

Issue Links

• is part of: TAPESTRY-2563 Tapestry should reject form submissions that aren't via POST or don't contain t:formdata, as likely hack attempts