Index: includes/form.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/form.inc,v
retrieving revision 1.426
diff -u -p -r1.426 form.inc
--- includes/form.inc	8 Jan 2010 06:36:34 -0000	1.426
+++ includes/form.inc	9 Jan 2010 20:00:29 -0000
@@ -237,7 +237,7 @@ function drupal_build_form($form_id, &$f
   // passing in the latest $form_state in addition to any other variables passed
   // into drupal_get_form().
   if ($form_state['rebuild'] && $form_state['process_input'] && !form_get_errors()) {
-    $form = drupal_rebuild_form($form_id, $form_state);
+    $form = drupal_rebuild_form($form_id, $form_state, $form_build_id);
   }
   // After processing the form, the form builder or a #process callback may
   // have set $form_state['cache'] to indicate that the original form and the
@@ -731,7 +731,11 @@ function drupal_prepare_form($form_id, &
     $form['#id'] = drupal_html_id($form_id);
   }
 
+  if (isset($form_state['action'])) {
+    $form['#action'] = $form_state['action'];
+  }
   $form += element_info('form');
+  $form_state['action'] = $form['#action'];
   $form += array('#tree' => FALSE, '#parents' => array());
 
   if (!isset($form['#validate'])) {
@@ -1215,12 +1219,9 @@ function form_builder($form_id, $element
 
   // Special handling if we're on the top level form element.
   if (isset($element['#type']) && $element['#type'] == 'form') {
-    if (!empty($element['#https']) && variable_get('https', FALSE) &&
-        !url_is_external($element['#action'])) {
-      global $base_root;
-
-      // Not an external URL so ensure that it is secure.
-      $element['#action'] = str_replace('http://', 'https://', $base_root) . $element['#action'];
+    // Ensure that internal URLs are secure when HTTPS is enabled.
+    if (!empty($element['#https']) && variable_get('https', FALSE) && !url_is_external($element['#action'])) {
+      $element['#action'] = str_replace('http://', 'https://', $GLOBALS['base_root']) . $element['#action'];
     }
 
     // Store a complete copy of the form in form_state prior to building the form.
@@ -2881,9 +2882,14 @@ function theme_textfield($variables) {
  */
 function theme_form($variables) {
   $element = $variables['element'];
+  if ($element['#action']) {
+    $element['#attributes']['action'] = check_url($element['#action']);
+  }
+  $element['#attributes']['accept-charset'] = 'UTF-8';
+  $element['#attributes']['method'] = $element['#method'];
+  $element['#attributes']['id'] = $element['#id'];
   // Anonymous div to satisfy XHTML compliance.
-  $action = $element['#action'] ? 'action="' . check_url($element['#action']) . '" ' : '';
-  return '<form ' . $action . ' accept-charset="UTF-8" method="' . $element['#method'] . '" id="' . $element['#id'] . '"' . drupal_attributes($element['#attributes']) . ">\n<div>" . $element['#children'] . "\n</div></form>\n";
+  return '<form' . drupal_attributes($element['#attributes']) . ">\n<div>" . $element['#children'] . "\n</div></form>\n";
 }
 
 /**