[ https://issues.apache.org/jira/browse/WICKET-6708?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Martin Tzvetanov Grigorov resolved WICKET-6708. ----------------------------------------------- Fix Version/s: 7.16.0 9.0.0-M4 8.7.0 Resolution: Fixed > FormComponent should read only the GET/POST parameters of the request, not > both > ------------------------------------------------------------------------------- > > Key: WICKET-6708 > URL: https://issues.apache.org/jira/browse/WICKET-6708 > Project: Wicket > Issue Type: Bug > Components: wicket > Affects Versions: 8.6.1, 7.15.0, 9.0.0-M3 > Reporter: Martin Tzvetanov Grigorov > Assignee: Martin Tzvetanov Grigorov > Priority: Major > Fix For: 8.7.0, 9.0.0-M4, 7.16.0 > > > org.apache.wicket.markup.html.form.FormComponent#getInputAsArray() currently > uses org.apache.wicket.request.Request#getRequestParameters() to read the > value(s) of their respective parameter. > It should use only the parameters for the actual method (GET or POST) instead > to prevent any data leakage. > If form submit is in place then the method mismatch should be handled at > org.apache.wicket.markup.html.form.Form#onMethodMismatch() -- This message was sent by Atlassian Jira (v8.3.4#803005)