original params are chained when redirecting

[skufle]

Seems like Grails 3.3.3 has introduced a bug where the original input params are chained when redirecting.

See the screenshots for example and notice the URL change in request params when redirected to index page on Grails 3.3.3

Steps to Reproduce

1. Create simple app with a few fields that redirects to index with not found when create is submitted
2. Notice that the original input params to save are added to the index URL

Expected Behaviour

Should not chain the original input parameters

Actual Behaviour

Original input parameters are chained

Environment Information

• Operating System: Ubuntu
• Grails Version: 3.3.3
• JDK Version: 1.8.0_131

Example Application

https://github.com/skufle/redirectbug

[jeffscottbrown]

Possibly related to some of this...

a7c5874#diff-9e4f34554ed5b8c51b79aa7900c7dafc

c815fea#diff-9e4f34554ed5b8c51b79aa7900c7dafc

a8e2280#diff-9e4f34554ed5b8c51b79aa7900c7dafc

62cd7d6#diff-9e4f34554ed5b8c51b79aa7900c7dafc

[jamescookie]

I was upgrading to 3.3.3 from 3.3.0 and found this problem prevents a delete actionSubmit tag from working.
I have two actionSubmits (one for delete and one for update) on an edit page, therefore need to remove the 'method' from the form:

    <g:form resource="${this.thing}">
        <g:hiddenField name="version" value="${this.thing?.version}" />
        <fieldset class="form">
            <f:all bean="thing"/>
        </fieldset>
        <fieldset class="buttons">
            <g:actionSubmit class="save" action="update" value="${message(code: 'default.button.update.label', default: 'Update')}" />
            <g:actionSubmit class="delete" action="delete" value="${message(code: 'default.button.delete.label', default: 'Delete')}" formnovalidate="" onclick="return confirm('${message(code: 'default.button.delete.confirm.message', default: 'Are you sure?')}');" />
        </fieldset>
    </g:form>

However, as the params (including the _method) are now passed on by the redirect of the delete to the index (which is not allowed to delete), you get a 405.

Also, when editing a large form, the url for the next page is terrible as it includes all the fields.

[jamescookie]

Note: This bug was introduced fixing: #10622

[ilopmar]

@jamescookie I've fixed the original problem reported in this issue. To make sure that your code also works, could you please create a sample project that reproduces the issue and share here the github url?

[jamescookie]

See this project: https://github.com/jamescookie/grails-bug-redirect
Create a thing, then delete it (via the edit page), you'll get a 405

[ilopmar]

Thanks for the sample project. I've been taking a look and the code is not working in Grails 3.3.0, although it's not the same problem as in Grails 3.3.3. The issue is that actionSubmit behaves "special". From https://gsp.grails.org/latest/ref/Tags/actionSubmit.html:

The implementation of the actionSubmit tag means that it does not sit entirely comfortably with URL mappings, particularly the default one. The reason for this is that URL mappings work on the URL of the request, but actionSubmit uses a parameter to determine the action to execute.

If you inspect the HTML generated by the tag:

<form action="/thing/index/3" method="post" >
	<input type="hidden" name="version" value="0" id="version" />
	<fieldset class="form">
		<div class='fieldcontain required'>
			<label for='name'>Name
			<span class='required-indicator'>*</span>
			</label>
			<input type="text" name="name" value="999" required="" id="name" />
		</div>
	</fieldset>
	<fieldset class="buttons">
		<input type="submit" name="_action_Update" value="Update" class="save" />
		<input type="submit" name="_action_Delete" value="Delete" class="delete" formnovalidate="" onclick="return confirm(&#39;Are you sure?&#39;);" />
	</fieldset>
</form>

You can see that the form action is /thing/index/3 and the HTTP method is POST. Before calling the action on the controller Grails checks the allowedMethods and the parameters are actionName = update and HTTP method = POST. That method is not allowed for your action, hence the 405.
If you change allowedMethods in ThingController to:

static allowedMethods = [save: "POST", update: ["PUT", "POST"], delete: ["DELETE", "POST"]]

or

static allowedMethods = [save: "POST", update: "POST", delete: "POST"]

Then everything works again.

After trying with my local Grails version with the original issue fixed, you still need to change the allowedMethods to make it work. With that, then everything works as expected.

[sarbyn]

There is any work-around? I found the same issue after upgrading to grails 3.3.3 and now any redirect put the params in the original request and, for example, if I'm editing an user password the password is shown in my browser navigation bar....

With grails 3.3.2 all works fine

[erichelgeson]

I just noticed this yesterday as well - post data is put in as get params on redirect - very unexpected behavior.

[jeffscottbrown]

The problem is understood and I expect the fix will be included in 3.3.4.