*
* CLK-289.
*/
public void testOnSubmitCheckMissingParam() {
MockContext context = (MockContext) MockContext.initContext("test-form.htm");
MockRequest request = (MockRequest) context.getMockRequest();
request.getParameterMap().put("form_name", "form");
Page page = new Page();
Form form = new Form("form");
// Construct name of submit token
String submitTokenName = Form.SUBMIT_CHECK + form.getName() + "_" + context.getResourcePath();
// Ensure there are no submitCheck hidden field yet
Field submitCheckField = form.getField(submitTokenName);
Assert.assertNull(submitCheckField);
// Simulate a submit check
boolean valid = form.onSubmitCheck(page, "/invalid-submit.html");
Assert.assertTrue(valid);
// Add the submitCheckField name and value to the parameters.
submitCheckField = form.getField(submitTokenName);
request.setParameter(submitTokenName, submitCheckField.getValue());
// If we submit again, the assert should be true because the submit
// token is set in the request parameters.
valid = form.onSubmitCheck(page, "/invalid-submit.html");
Assert.assertTrue(valid);
// Now imagine the SUBMIT_CHECK token is removed by a hacker. To simulate
// such a scenario we remove the submitTokenName from the request paramters.
request.removeParameter(submitTokenName);
valid = form.onSubmitCheck(page, "/invalid-submit.html");
Assert.assertFalse(valid);
}