Index: includes/form.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/form.inc,v
retrieving revision 1.467
diff -u -r1.467 form.inc
--- includes/form.inc	5 Jun 2010 13:18:09 -0000	1.467
+++ includes/form.inc	8 Jun 2010 17:43:43 -0000
@@ -203,8 +203,11 @@
       }
 
       $form = drupal_retrieve_form($form_id, $form_state);
-      $form_build_id = 'form-' . drupal_hash_base64(uniqid(mt_rand(), TRUE) . mt_rand());
-      $form['#build_id'] = $form_build_id;
+
+      if (!isset($form['#action'])) {
+        $form_build_id = 'form-' . drupal_hash_base64(uniqid(mt_rand(), TRUE) . mt_rand());
+        $form['#build_id'] = $form_build_id;
+      }
 
       // Fix the form method, if it is 'get' in $form_state, but not in $form.
       if ($form_state['method'] == 'get' && !isset($form['#method'])) {
@@ -730,7 +733,7 @@
   // tokens are session-bound and forms displayed to anonymous users are very
   // likely cached, we cannot assign a token for them.
   // During installation, there is no $user yet.
-  if (!empty($user->uid) && !$form_state['programmed']) {
+  if (!empty($user->uid) && !$form_state['programmed'] && !isset($form['#action'])) {
     // Form constructors may explicitly set #token to FALSE when cross site
     // request forgery is irrelevant to the form, such as search forms.
     if (isset($form['#token']) && $form['#token'] === FALSE) {
@@ -747,7 +750,7 @@
     }
   }
 
-  if (isset($form_id)) {
+  if (isset($form_id) && !isset($form['#action'])) {
     $form['form_id'] = array(
       '#type' => 'hidden',
       '#value' => $form_id,