confirm_form() does not allow empty description strings [#100747]

The signature for function confirm_form() is

confirm_form($form_id, $form, $question, $path, $description = NULL, $yes = NULL, $no = NULL, $name = 'confirm')

and there is a line of code in the function that reads:

$description = ($description) ? $description : t('This action cannot be undone.');

However, sometimes the $question parameter does not need an accompanying description AND the action *can* be undone. However, if you pass an empty string for $description, the said line of code forces the description to be t('This action cannot be undone.'). A coder should be able to pass an empty string for the description. This is possible with a simple change to:

$description = ($description) ? is_null($description) : t('This action cannot be undone.');

The attached patch does this.

Comment	File	Size	Author
#2	confirm_d	601 bytes	chx
	system.module.diff.txt	878 bytes	ankur

Comments

Comment #1

ankur commented 1 December 2006 at 03:41

Whoops, I meant to say that the modified line should read:

$description = is_null($description) ? $description : t('This action cannot be undone.');

The original attachment reads correctly.

Comment #2

chx commented 13 December 2006 at 23:40

Status:

Active

» Reviewed & tested by the community

Status	File	Size
new	confirm_d	601 bytes

rerolled with isset.

Comment #3

Steven commented 15 December 2006 at 08:00

If the action can be undone, should you use a confirmation form? Explaining the consequences of an action is always a good thing, but it might not be needed in this case. I'm tempted to wontfix.

Comment #4

ankur commented 15 December 2006 at 21:50

This is the context in which this bug came up for me:

I was adding a feature to buddylist so it can be configured so that a user must get the other person's approval to be their buddy. So, when someone tries to add someone else as a buddy, we give them the confirmation screen. However, the request to be someone's buddy can be cancelled (e.g., the action can be undone). I was trying to implement the feature in the way it works on Friendster or MySpace: You click a link to be someone's buddy -> you click a button on a confirm screen if you are sure -> you can always cancel the request later.

And there is a slight difference: if you click 'no' on the buddy-add-request confirmation screen, the email never goes out to the other person. If you click 'yes', an email goes out to the requestee to notify the other user of the add-request and in the meantime, you can cancel the request. So in short I'm saying that the action can be undone, but it can be confirmed and undone, but stuff can still happen in between.