reiern70 commented on code in PR #1160:
URL: https://github.com/apache/wicket/pull/1160#discussion_r2083532580
##########
wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/resource/AbstractFileUploadResource.java:
##########
@@ -269,18 +270,31 @@ private Bytes getMaxSize(ServletWebRequest webRequest)
*/
private Bytes getFileMaxSize(ServletWebRequest webRequest)
{
- long fileMaxSize =
webRequest.getRequestParameters().getParameterValue("fileMaxSize").toLong(-1);
+ // WICKET-7154 we need to avoid reading POST parameters
+ long fileMaxSize =
webRequest.getQueryParameters().getParameterValue("fileMaxSize").toLong(-1);
return fileMaxSize > 0 ? Bytes.bytes(fileMaxSize) : null;
}
+ /**
+ * Return the unique ID identifying the upload.
+ *
+ * @return String
+ */
+ private String getUploadId(ServletWebRequest webRequest)
Review Comment:
Thanks for your comments!
- Yes I think adding the comments to getQueryParameters is needed.
- We have methods for getMaxFileSize and family... My rationale was to give
users the opportunity to generate the ID in any other way they deem possible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
