If you POST an invalid form build ID to the JS callback, it does not
check whether a value is retrieved from the cache. It then sets data
in the cache using this invalid ID. So – when this callback is
invoked again it will retrieve the data. This invalid ID in the
cache may cause future problems. So, there needs to be a
check that the original ID was valid.
Similar issue for core: http://drupal.org/node/222588
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | cck_problem_post_270827_3.patch | 2.31 KB | pwolanin |
| #2 | cck_problem_post_270827_2.patch | 2.16 KB | pwolanin |
| #1 | cck_problem_post.patch | 1.84 KB | pwolanin |
Comments
Comment #1
pwolanin commentedlooking at this function:
http://api.drupal.org/api/function/form_get_cache/6
It seems we would lose the 'storage' if you use the code I originally suggested (attached).
So the question is really whether it's correct to set $form_state['values'] to $_POST.
Comment #2
pwolanin commentedok, here's a patch that seems to actually work.
Comment #3
pwolanin commentedslightly better - this prevents the log from filling with PHP errors if you just visit the callback path.
Comment #4
yched commentedTested and committed. Thanks !
Comment #5
Anonymous (not verified) commentedAutomatically closed -- issue fixed for two weeks with no activity.