| Subject: | CGI hidden values within form appearing on link |
| Date: | Tue, 22 Apr 2008 16:08:45 -0500 |
| To: | <bug-CGI.pm [...] rt.cpan.org> |
| From: | "Vanole, Mike" <MV5492 [...] att.com> |
Hi,
I reported this as a webserver7 problem, but playing around with CGI
versions revealed CGI.pm was causing odd behavior.
Problem noticed at CGI.pm-3.33
Problem still there at CGI.pm-3.35
Downgraded to version CGI.pm-3.15 and the problem goes away.
Here is the code for a test cgi that replicates the problem to see
exactly what I'm talking about. At 3.33 and above clicking the buttons
as directed reveals the values in the URL at the second button click
when we expect them to remain hidden. The second form submission somehow
gets transformed from a POST to a GET. The same cgi running under 3.15
and lower keeps the values hidden.
perl 5.8.8 on Solaris 9
#!/usr/local/bin/perl
use CGI;
use CGI::Carp qw(fatalsToBrowser);
$q = new CGI;
print $q->header;
print $q->start_html("test");
$ASCS1chk = $q->param('ASCS1');
$ASCS2chk = $q->param('ASCS2');
print "<CENTER>";
if (length($ASCS1chk) != 0)
{
&ASC_2();
}
elsif (length($ASCS2chk) != 0)
{
&junk();
}
else
{
&ASC_1();
}
sub ASC_1
{
$USERID = 'jj';
print $q->start_form();
print "<table border=0 width=400 cellspacing=2 cellpadding=0>";
print "<tr><td align=left class=ctm> </td>";
undef @ATempArray;
push(@ATempArray,'Account ET - CARE History');
push(@ATempArray,'Audits');
if ($#ATempArray != -1)
{
print "<tr><td align=left width=30% class=ctm> </td>";
print "<tr><td><td align=right class=ctf colspan=6>";
print $q->hidden(-name=>'USER_IN',-value=>$USERID,-force=>1);
print $q->submit(-style=>'font-family:arial; font-size:
11;',-name=>'ASCS1',-value=>'Click this button');
print $q->end_form;
}
print "</table>";
}
sub ASC_2
{
$USERID1 = $q->param('USER_IN');
$ASCUPD_CHK = $q->param('ASCUPD');
print "<table border=0 width=400 cellspacing=2 cellpadding=0>";
print $q->start_form(-name=>'OV2');
print "<tr><td align=left class=ctf nowrap valign=top>";
print $q->hidden(-name=>'ORIGASC',-value=>$ASCUPD_CHK,-force=>1);
print $q->hidden(-name=>'USER_IN2',-value=>$USERID1,-force=>1);
print $q->hidden(-name=>'DFHR',-value=>$DefHR,-force=>1);
print $q->hidden(-name=>'DFHM',-value=>$DefMN,-force=>1);
print $q->hidden(-name=>'ACTDT',-value=>$OVDate,-force=>1);
print "<tr><td align=center valign=top> ";
print "<tr><td align=center valign=top> ";
print "<tr><td align=right valign=top colspan=2>";
print $q->submit(-style=>'font-family:arial; font-size:
11;',-name=>'ASCS2',-value=>'Now Click this button');
print $q->end_form();
print "<tr><td align=right valign=top colspan=6>";
print "</table>";
}
sub junk
{
print "The values you see in the address line are hidden values within a
form. We are not expecting them to be displayed here. Usually they are
not displayed in this line. There are no alink refs within this cgi";
}
Please let me know if there is more I can provide.
Thanks for a great perl module!
Mike