Do not set the full url from the request as action with form parameters

Setting an url with parameters named like form elements in a form with method POST causes Zend to ignore any POST data because GET will be processed with higher priority. fixes #6806
Icinga · Aug 13, 2014 · 7311ab9 · 7311ab9
1 parent e7da9c0
commit 7311ab9
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 6 deletions.
diff --git a/library/Icinga/Web/Form.php b/library/Icinga/Web/Form.php
@@ -7,7 +7,6 @@
 use LogicException;
 use Zend_Form;
 use Zend_View_Interface;
-use Icinga\Application\Icinga;
 use Icinga\Web\Form\Decorator\HelpText;
 use Icinga\Web\Form\Decorator\ElementWrapper;
 use Icinga\Web\Form\Element\CsrfCounterMeasure;
@@ -131,14 +130,15 @@ public function getTokenElementName()
     public function create(array $formData = array())
     {
         if (false === $this->created) {
+            $this->addElements($this->createElements($formData));
+            $this->addCsrfCounterMeasure()->addSubmitButton();
+
             if ($this->getAction() === '') {
                 // We MUST set an action as JS gets confused otherwise, if
                 // this form is being displayed in an additional column
-                $this->setAction(Icinga::app()->getFrontController()->getRequest()->getRequestUri());
+                $this->setAction(Url::fromRequest()->getUrlWithout(array_keys($this->getElements())));
             }
 
-            $this->addElements($this->createElements($formData));
-            $this->addCsrfCounterMeasure()->addSubmitButton();
             $this->created = true;
         }
 

diff --git a/library/Icinga/Web/Widget/SortBox.php b/library/Icinga/Web/Widget/SortBox.php
@@ -132,7 +132,6 @@ public function render()
         $sort = $form->getElement('sort')->setDecorators(array('ViewHelper'));
         $dir = $form->getElement('dir')->setDecorators(array('ViewHelper'));
         if ($this->request) {
-            $form->setAction($this->request->getRequestUri());
             $form->populate($this->request->getParams());
         }
         return $form;

diff --git a/modules/monitoring/library/Monitoring/Web/Widget/TimelineIntervalBox.php b/modules/monitoring/library/Monitoring/Web/Widget/TimelineIntervalBox.php
@@ -97,7 +97,6 @@ public function render()
         );
 
         if ($this->request) {
-            $form->setAction($this->request->getRequestUri());
             $form->populate($this->request->getParams());
         }