Problem/Motivation

$form_state['input'] is very dangerous, it'd be good to have a method documented explaining that.

Proposed resolution

Remaining tasks

User interface changes

API changes

Commit message.

Issue #2318087 by tim.plunkett, jibran: Replace $form_state['input'] with FormState::getUserInput().

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

tim.plunkett’s picture

Status: Active » Needs review
FileSize
52.53 KB
jibran’s picture

Well I love this patch. I am ++ on using $input = &$form_state->getUserInput(); to set or get the values from the FormStateInterface::$input. And it'll discourage user to use it. I haven't found any objectionable thing while reviewing it. So nothing to fix here.

  1. +++ b/core/lib/Drupal/Core/Form/FormBuilder.php
    @@ -176,9 +176,10 @@ public function buildForm($form_id, FormStateInterface &$form_state) {
    +    $input = &$form_state->getUserInput();
    +    if (!isset($input)) {
    

    Nice!!!

  2. +++ b/core/modules/system/src/Tests/Batch/ProcessingTest.php
    @@ -105,7 +105,7 @@ function testBatchFormMultipleBatches() {
    -    // hanlders and logging of corresponding $form_state[{values'].
    
    @@ -123,7 +123,7 @@ function testBatchFormProgrammatic() {
    -    // hanlders and logging of corresponding $form_state[{values'].
    

    lol hanlders and $form_state[{values']

  3. +++ b/core/modules/views_ui/admin.inc
    @@ -328,7 +328,9 @@ function views_ui_standard_display_dropdown(&$form, FormStateInterface $form_sta
    -  $path = "admin/structure/views/$ajax/$form_state[form_key]/$name/$form_state[display_id]";
    +  $form_key = $form_state->get('form_key');
    +  $display_id = $form_state->get('display_id');
    +  $path = "admin/structure/views/$ajax/$form_key/$name/$display_id";
    

    I am going to let this slide :D

jibran’s picture

Status: Needs review » Reviewed & tested by the community

Green. I'll add it to main change notice.

jibran’s picture

alexpott’s picture

+++ b/core/lib/Drupal/Core/Installer/Form/SiteSettingsForm.php
@@ -43,22 +43,23 @@ public function buildForm(array $form, FormStateInterface $form_state) {
+    $input = &$form_state->getUserInput();
+    if (!isset($input['driver']) && $database = Database::getConnectionInfo()) {
+      $input['driver'] = $database['default']['driver'];

Using a method called getUserInput to set user input feels icky. Especially since we have a few $form_state->set('input,.. around.

Not sure if we should be doing it this way.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 1: form_state-input-2318087-1.patch, failed testing.

tim.plunkett’s picture

Status: Needs work » Needs review
FileSize
53.56 KB

Fair enough. We should have methods for everything.

tim.plunkett’s picture

FileSize
53.92 KB
20 KB

Ugh, wrong patch and forgot interdiff.

The last submitted patch, 7: form_state-input-2318087-7.patch, failed testing.

jibran’s picture

+++ b/core/lib/Drupal/Core/Form/FormStateInterface.php
@@ -176,6 +176,28 @@ public function has($property);
+   * These are raw and unvalidated, so should not be used without a thorough
+   * understanding of security implications. In almost all cases, code should
+   * use self::getValues() and self::getValue() exclusively.

Should these docs be added to setUserInput as well? Or something similar.

tim.plunkett’s picture

I don't think additional docs are needed. setUserInput() is not dangerous, since you're saying "this is unfiltered". Only getting the unfiltered values and using them like they're safe is the problem.

casey’s picture

What about getRawInput()? I think such name better explains what the method returns.

jibran’s picture

Issue summary: View changes
Status: Needs review » Reviewed & tested by the community

Input is always raw so naming it getRawInput doesn't make sense.
@tim.plunkett thanks for the explanation.
As #5 is addressed so RTBC. Added suggested commit message to issue summary.

webchick’s picture

Status: Reviewed & tested by the community » Fixed

Committed and pushed to 8.x. Thanks!

  • webchick committed de5fe26 on 8.0.x
    Issue #2318087 by tim.plunkett: Replace ['input'] with FormState::...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.