{"action":"created","issue":{"url":"https://api.github.com/repos/topolik/liferay-portal/issues/137","labels_url":"https://api.github.com/repos/topolik/liferay-portal/issues/137/labels{/name}","comments_url":"https://api.github.com/repos/topolik/liferay-portal/issues/137/comments","events_url":"https://api.github.com/repos/topolik/liferay-portal/issues/137/events","html_url":"https://github.com/topolik/liferay-portal/pull/137","id":65554775,"number":137,"title":"LPS-54599 CSRF token is included in URL when a form submission fails","user":{"login":"Preston-Crary","id":1714297,"avatar_url":"https://avatars.githubusercontent.com/u/1714297?v=3","gravatar_id":"","url":"https://api.github.com/users/Preston-Crary","html_url":"https://github.com/Preston-Crary","followers_url":"https://api.github.com/users/Preston-Crary/followers","following_url":"https://api.github.com/users/Preston-Crary/following{/other_user}","gists_url":"https://api.github.com/users/Preston-Crary/gists{/gist_id}","starred_url":"https://api.github.com/users/Preston-Crary/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Preston-Crary/subscriptions","organizations_url":"https://api.github.com/users/Preston-Crary/orgs","repos_url":"https://api.github.com/users/Preston-Crary/repos","events_url":"https://api.github.com/users/Preston-Crary/events{/privacy}","received_events_url":"https://api.github.com/users/Preston-Crary/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-31T21:50:25Z","updated_at":"2015-04-07T16:56:42Z","closed_at":"2015-04-07T16:56:42Z","pull_request":{"url":"https://api.github.com/repos/topolik/liferay-portal/pulls/137","html_url":"https://github.com/topolik/liferay-portal/pull/137","diff_url":"https://github.com/topolik/liferay-portal/pull/137.diff","patch_url":"https://github.com/topolik/liferay-portal/pull/137.patch"},"body":"In the case of a failed form submission sending a redirect would remove the form data.  So, instead I just move the token for forms."},"comment":{"url":"https://api.github.com/repos/topolik/liferay-portal/issues/comments/90645423","html_url":"https://github.com/topolik/liferay-portal/pull/137#issuecomment-90645423","issue_url":"https://api.github.com/repos/topolik/liferay-portal/issues/137","id":90645423,"user":{"login":"topolik","id":148147,"avatar_url":"https://avatars.githubusercontent.com/u/148147?v=3","gravatar_id":"","url":"https://api.github.com/users/topolik","html_url":"https://github.com/topolik","followers_url":"https://api.github.com/users/topolik/followers","following_url":"https://api.github.com/users/topolik/following{/other_user}","gists_url":"https://api.github.com/users/topolik/gists{/gist_id}","starred_url":"https://api.github.com/users/topolik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/topolik/subscriptions","organizations_url":"https://api.github.com/users/topolik/orgs","repos_url":"https://api.github.com/users/topolik/repos","events_url":"https://api.github.com/users/topolik/events{/privacy}","received_events_url":"https://api.github.com/users/topolik/received_events","type":"User","site_admin":false},"created_at":"2015-04-07T16:56:42Z","updated_at":"2015-04-07T16:56:42Z","body":"I'm sorry, I have to close it.\r\n\r\nI checked it also with @rotty3000, it's not possible to fix it this way. Portal cannot read request parameters that are in the upload request body (posting blog entry, message boards, web content, ...). \r\n\r\nThere could be a way for built-in portlets but not for 3rd party portlets where the upload request parsing is done by the portlets themselves and portal has no knowledge about data inside the upload request. We could break existing customer portlets that use <aui:form>.\r\n\r\nI firmly believe the only global solution in our situation are one-time tokens. This would fix everything and everywhere."}}