0

In spring forms I have hidden input

like 

<form:form method="post" modelAttribute="order" name="..." action="processListOrdersSelect.html">
            <p>
                <label for="username">Select Username:</label>
                <form:select path="username">
                    <form:option value="j2ee" label="j2ee" />
                </form:select>
            </p>

            <input type="hidden" name="test" value="test" />
            <form:button onclick="submit()">View Orders</form:button>
</form:form>

when I submit with this form ,Hdiv security give me unauthorized access, I think that Hdiv didn't use the input hidden fields while generating the Hdiv _HDIV_STATE_ for the parameter tampering. how to let Hdiv use my hidden input without using the 

<form:hidden path="test" value="test" />

because I don't have any value bean for this property tag. and I want Hdiv to validate the hidden input not to skip them using 

<hdiv:paramsWithoutValidation> 
    <hdiv:mapping url="/.*" parameters="test" />
</hdiv:paramsWithoutValidation>

please tell me how to solve this issue ??

Abd-Alhaj
  • 1
  • 1
  • 2

1 Answers1

1

Hdiv is aware of the form fields generated using tags like <form:hidden>, as the value of the parameter is obtained from Spring MVC tags. If a form field is generated without Spring MVC tag it is not processed by Hdiv and is considered as a new field included by the client.

Use Spring tag or exclude parameter validation as you mentioned in the question.

gillarramendi
  • 271
  • 1
  • 8
  • Yes I know that, but I have to use without using tag because I don't need this value for my model and solve this issue by using tld org.hdiv.tags.CipherTag with " /> in my form – Abd-Alhaj Oct 26 '18 at 11:29
  • Thanks about your answer gillarramendi.When i use in value of of hidden it's work ,but when use it in form field with type text not working.I have huge system to change it all to spring MVC tag.Please tell me if there are any way to use hdiv with form field without spring MVC tag. – Abd-Alhaj Oct 28 '18 at 08:25