martin-g commented on code in PR #1160:
URL: https://github.com/apache/wicket/pull/1160#discussion_r2083511444
##########
wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/resource/AbstractFileUploadResource.java:
##########
@@ -269,18 +270,31 @@ private Bytes getMaxSize(ServletWebRequest webRequest)
*/
private Bytes getFileMaxSize(ServletWebRequest webRequest)
{
- long fileMaxSize =
webRequest.getRequestParameters().getParameterValue("fileMaxSize").toLong(-1);
+ // WICKET-7154 we need to avoid reading POST parameters
+ long fileMaxSize =
webRequest.getQueryParameters().getParameterValue("fileMaxSize").toLong(-1);
return fileMaxSize > 0 ? Bytes.bytes(fileMaxSize) : null;
}
+ /**
+ * Return the unique ID identifying the upload.
+ *
+ * @return String
+ */
+ private String getUploadId(ServletWebRequest webRequest)
Review Comment:
Is this method really needed ? It is called just once and its body is a
single line ?
##########
wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/resource/AbstractFileUploadResource.java:
##########
@@ -269,18 +270,31 @@ private Bytes getMaxSize(ServletWebRequest webRequest)
*/
private Bytes getFileMaxSize(ServletWebRequest webRequest)
{
- long fileMaxSize =
webRequest.getRequestParameters().getParameterValue("fileMaxSize").toLong(-1);
+ // WICKET-7154 we need to avoid reading POST parameters
+ long fileMaxSize =
webRequest.getQueryParameters().getParameterValue("fileMaxSize").toLong(-1);
return fileMaxSize > 0 ? Bytes.bytes(fileMaxSize) : null;
}
+ /**
+ * Return the unique ID identifying the upload.
+ *
+ * @return String
+ */
+ private String getUploadId(ServletWebRequest webRequest)
Review Comment:
IMO it would be better to have a method that returns
`webRequest.getQueryParameters()` with a Javadoc explaining why reading POST
parameters should be avoided.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
