{"record":{"id":"fdfda4d01383879a","repo":"theonedev/onedev","slug":"pop-state-data-is-missing","errorCode":null,"errorMessage":"Pop state data is missing","messagePattern":"Pop state data is missing","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"server-core/src/main/java/io/onedev/server/web/page/base/BasePage.java","lineNumber":247,"sourceCode":"\t\t\t\t&& new File(Bootstrap.installDir, Upgrade.INCOMPATIBILITIES_SINCE_UPGRADED_VERSION_FILE).exists()) {\n\t\t\tthrow new RestartResponseAtInterceptPageException(IncompatibilitiesPage.class);\n\t\t}\n\n\t\tAbstractPostAjaxBehavior popStateBehavior;\n\t\tadd(popStateBehavior = new AbstractPostAjaxBehavior() {\n\n\t\t\t@Override\n\t\t\tprotected void updateAjaxAttributes(AjaxRequestAttributes attributes) {\n\t\t\t\tsuper.updateAjaxAttributes(attributes);\n\t\t\t\tattributes.setMethod(Method.POST);\n\t\t\t}\n\n\t\t\t@Override\n\t\t\tprotected void respond(AjaxRequestTarget target) {\n\t\t\t\tIRequestParameters params = RequestCycle.get().getRequest().getPostParameters();\n\t\t\t\tString encodedData = params.getParameterValue(\"data\").toString();\n\t\t\t\tif (encodedData == null) \n\t\t\t\t\tthrow new BadRequestException(\"Pop state data is missing\");\n\n\t\t\t\tbyte[] bytes = Base64.decodeBase64(encodedData.getBytes());\n\t\t\t\tSerializable data = (Serializable) SerializationUtils.deserialize(CryptoUtils.decrypt(bytes));\n\t\t\t\tonPopState(target, data);\n\t\t\t\tresizeWindow(target);\n\t\t\t\ttarget.appendJavaScript(\"onedev.server.viewState.getFromHistoryAndSetToView();\");\n\t\t\t}\n\n\t\t});\n\n\t\tadd(new Label(\"pageTitle\", getPageTitle()) {\n\n\t\t\t@Override\n\t\t\tpublic void renderHead(IHeaderResponse response) {\n\t\t\t\tsuper.renderHead(response);\n\n\t\t\t\tresponse.render(JavaScriptHeaderItem.forReference(new BaseResourceReference()));\n","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/page/base/BasePage.java#L229-L265","documentation":"BasePage installs an AJAX behavior for browser popstate (history back/forward). The behavior reads the 'data' post parameter containing encrypted/serialized view state; if the parameter is absent it throws BadRequestException('Pop state data is missing').","triggerScenarios":"An AJAX popstate callback arrives without the expected 'data' parameter, typically from a crafted/stale request or an old browser state that predates the parameter being sent.","commonSituations":"Stale browser tabs after a OneDev upgrade; scripting/testing tools hitting the AJAX endpoint directly; corrupted history state.","solutions":["Reload the page fresh (F5) so the client sends full view state.","Clear browser history/cache for the OneDev site.","Retry after a hard refresh; if scripting the endpoint, always include the base64 'data' parameter."],"exampleFix":"// before: POST without body param\n// after\nPOST data=<base64-encoded encrypted state>","handlingStrategy":"try-catch","validationCode":"if (!postParams.contains(\"data\")) { reloadPage(); return; }","typeGuard":null,"tryCatchPattern":"try {\n    respondPopState(params);\n} catch (BadRequestException e) {\n    // stale/missing history state: force a full reload\n    target.appendJavaScript(\"window.location.reload()\");\n}","preventionTips":["Hard-refresh stale tabs after OneDev upgrades.","Avoid replaying captured AJAX requests without the data parameter.","Clear site history/cache when popstate errors persist."],"tags":["wicket","ajax","browser-history","bad-request"],"backgroundTag":"invalid-query-parameter","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}