if (StringUtils.isBlank(getName())) {
throw new IllegalStateException("Form name is not defined.");
}
// CLK-333. Don't regenerate submit tokens for Ajax requests.
Context context = getContext();
if (context.isAjaxRequest()) {
return true;
}
String resourcePath = context.getResourcePath();
int slashIndex = resourcePath.indexOf('/');
if (slashIndex != -1) {
resourcePath = resourcePath.replace('/', '_');
}
// Ensure resourcePath starts with a '_' separator. If slashIndex == -1
// or slashIndex > 0, resourcePath does not start with slash.
if (slashIndex != 0) {
resourcePath = '_' + resourcePath;
}
final HttpServletRequest request = context.getRequest();
final String submitTokenName =
SUBMIT_CHECK + getName() + resourcePath;
boolean isValidSubmit = true;
// If not this form exit
String formName = context.getRequestParameter(FORM_NAME);
// Only test if submit for this form
if (!context.isForward()
&& request.getMethod().equalsIgnoreCase(getMethod())
&& getName().equals(formName)) {
Long sessionTime =
(Long) context.getSessionAttribute(submitTokenName);
if (sessionTime != null) {
String value = context.getRequestParameter(submitTokenName);
if (value == null || value.length() == 0) {
// CLK-289. If a session attribute exists for the
// SUBMIT_CHECK, but no request parameter, we assume the
// submission is a duplicate and therefore invalid.
LogService logService = ClickUtils.getLogService();
logService.warn(" 'Redirect After Post' token called '"
+ submitTokenName + "' is registered in the session, "
+ "but no matching request parameter was found. "
+ "(form name: '" + getName()
+ "'). To protect against a 'duplicate post', "
+ "Form.onSubmitCheck() will return false.");
isValidSubmit = false;
} else {
Long formTime = Long.valueOf(value);
isValidSubmit = formTime.equals(sessionTime);
}
}
}
// CLK-267: check against adding a duplicate field
HiddenField field = (HiddenField) getField(submitTokenName);
if (field == null) {
field = new NonbindableHiddenField(submitTokenName, Long.class);
add(field);
insertIndexOffset++;
}
// Save state info to form and session
final Long time = System.currentTimeMillis();
field.setValueObject(time);
context.setSessionAttribute(submitTokenName, time);
if (isValidSubmit) {
return true;
} else {