The description of $form_state in drupal_build_form() has two major issues:

  1. The largest part of the description for values actually describes input.
  2. No description for input is given.

This change seems to have been made and committed 6 years ago and has gone unnoticed since (https://www.drupal.org/project/drupal/issues/699604#comment-6432636).

The description currently reads:

values: An associative array of values submitted to the form. The validation functions and submit functions use this array for nearly all their decision making. (Note that #tree determines whether the values are a flat array or an array whose structure parallels the $form array. See Form API reference for more information.) These are raw and unvalidated, so should not be used without a thorough understanding of security implications. In almost all cases, code should use the data in the 'values' array exclusively. The most common use of this key is for multi-step forms that need to clear some of the user input when setting 'rebuild'. The values correspond to $_POST or $_GET, depending on the 'method' chosen.

Comments

ciss created an issue. See original summary.

ciss’s picture

Issue summary: View changes
ciss’s picture

Issue summary: View changes

Summary referenced form_builder() instead of drupal_build_form().