Spring 14 problem with pages that share the same controller

Question

I think I've stumbled across a bug in Spring 14 that is breaking some of my code that is working in Winter 14.

I have two pages that share the same controller. A button on the first page renders the second page as a PDF and attaches it to the Case. This was working prior to Spring 14, but now I'm getting the following error when I click on the button: "The page you submitted was invalid for your session. Please click Save again to confirm your change. " I believe this error is due to changes in CSRF in Spring '14.

If I change the pages to use different controllers, the problem goes away. This isn't an option since I need to share the view state between the two pages. Data entered on the first page is used by the second page.

Last week, I was able to deactivate a critical update and get it working again, but that critical update (Enable CSRF protection on GET and POST requests) is no longer visible in my list of critical updates in my sandboxes. The sandboxes I deactivated it in work, but the ones I didn't deactivate it in don't work.

Can anyone else replicate? Does anyone have a solution or work around?

Here are the pages and classes to replicate:

public class CaseExtension{

    public Case c;

    public CaseExtension(ApexPages.StandardController stdController) {
        c = (Case)stdController.getRecord();
    }

    public PageReference nextPage() {
        Attachment att = New Attachment(Name = 'Test.pdf');
        att.parentId = c.Id;
        PageReference page = new PageReference('/apex/Case2?id=' + c.Id);
        att.Body = page.getContentAsPDF();
        insert att;
        return new PageReference('/' + att.Id);
    }
}

Case1 Page:

<apex:page standardController="Case" extensions="CaseExtension">
    <apex:form id="theForm">
        <apex:pageBlock >
            <apex:pageBlockSection title="Page 1">
                <apex:inputField value="{!Case.Description}"/>
            </apex:pageBlockSection>
            <apex:pageBlockButtons >
                <apex:commandButton action="{!nextPage}" value="Build PDF"/>
            </apex:pageBlockButtons>
        </apex:pageBlock>
    </apex:form>
</apex:page>

Case2 Page:

<apex:page standardController="Case" extensions="CaseExtension">
        <apex:pageBlock >
            <apex:pageBlockSection >
                <apex:outputText value="{!Case.Description}"/>
            </apex:pageBlockSection>
        </apex:pageBlock>
</apex:page>

Answer 1

I was able to replicate this issue, very interesting one. I'm not too sure why exactly you are getting this error. However you should save your case in your controller before to call your second page, that works for me :

public PageReference nextPage() {
        update c;
        Attachment att = New Attachment(Name = 'Test.pdf');
        att.parentId = c.Id;
        PageReference page = new PageReference('/apex/Case2?id=' + c.Id);
        att.Body = page.getContentAsPDF();
        insert att;
        return new PageReference('/' + att.Id);
    }

Answer 2

Salesforce R&D have confirmed this is a regression bug in Spring 14. It is now on the known issues site.

It looks like the problem is with declaring the pagereference instead of doing the better way and using Page.Case2. When I change the controller as below, it works. I have a case open with developer support. Maybe they will tell me why this is.

public class CaseExtension{

    public Case c;

    public CaseExtension(ApexPages.StandardController stdController) {
        c = (Case)stdController.getRecord();
    }

    public PageReference nextPage() {
        Attachment att = New Attachment(Name = 'Test.pdf');
        att.parentId = c.Id;
        att.Body = Page.Case2.getContentAsPDF();
        insert att;
        return new PageReference('/' + att.Id);
    }
}