Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
I'm currently working on the Drupal 6 version of the gallery module. One problem I discovered is this:
If you submit a form, that is not generated by Drupal (in this case a Gallery2 form) the index 'form_id' is not available in the #post array. This leads to a warning. The attached patch simply adds a isset($form['#post']['form_id'])
check to prevent forms API to handle the 'external' submit.
Comment | File | Size | Author |
---|---|---|---|
#2 | isset_form_id_2.patch | 980 bytes | profix898 |
isset_form_id.patch | 824 bytes | profix898 | |
Comments
Comment #1
Dries CreditAttribution: Dries commentedPlease add some code comments explaining this (i.e. the part about external forms).
Comment #2
profix898 CreditAttribution: profix898 commentedComments added. New patch attached.
Comment #3
Gábor HojtsyWell, anyone can set form_id in POST to something, so the comment is not really accurate. The check looks for the form_id and its equivalence with the form_id in the system to check whether it was a Drupal form sumission.
Comment #4
profix898 CreditAttribution: profix898 commented"Well, anyone can set form_id in POST to something, so the comment is not really accurate."
But form_id in $_POST must be the same as the current one generated in form_builder(). Why is this inaccurate?
"The check looks for the form_id and its equivalence with the form_id in the system to check whether it was a Drupal form sumission."
Not sure what you mean here!? Do you mean the isset() stuff is redundant? Or are you trying to reword the code comment?
Comment #5
Gábor HojtsyHere is your comment:
As I have said, whether the POST data has a form_id or not is not something which tells "internal" Drupal forms and externals apart. This long winded explanation easily misleads people.
Comment #6
profix898 CreditAttribution: profix898 commentedI agree that form_id being set does not necessarily mean its a Drupal generated form, but its likely missing if it is not. If you dont want the long comment, what else should I document here? I can only tell you that without the patch every (embedded) non-Drupal form causes a warning on submit. If form_id is set the
$form['#post']['form_id'] == $form_id
stuff checks whether it needs processing.Comment #7
Dries CreditAttribution: Dries commentedPersonally, I'm OK with the patch and its comment.
Goba: maybe you can massage the comment, and submit the patch -- unless you think this isn't the proper fix?
Comment #8
Gábor HojtsyOK, let the code intact and modified the comment to say:
instead of:
Note that additionally to what I already noticed, the comment also lacked the programmed form case.
Anyway, thanks for the fix, and excuse me if I was "too picky" about the comment. I think it is important to be precise if possible.
Comment #9
(not verified) CreditAttribution: commented