Due to the justifiably unexpected way in which form_execution_handlers works, if you set a validation function on a button then you lose any form validation handlers (in $form['#validate']) that were added.
All the buttons in the update form have been assigned '#validate' => array(), meaning that no custom non-core validation is performed whatsoever on our forms and the CSS-hidden values can easily be changed. This is also means that anyone that has modified field values during validation (i.e. the "Drupal-way") using form_set_value (or altering the $form_state manually) will not see these changes since the rebuilt form on the update confirmation page does not update the "input" array with values from the "values" array.
Proposed Fix:
Remove all instances of '#validate' => array() within date_repeat_entity_add_confirmation_buttons().
Comments
Comment #1
cmonnow commented