RULES and AJAX form support.

When you send a form(edit/create) to be validate, if you pass the form POST array serialized it WILL pass through ALL your rules you have made "while form being validate" or "post have been submitted" ... This can cause a major security flaw for someone who want to block some info to be recorded in database under certains circumstance... Form will "pass by" without stop ...

Exemple :

include a JS script in the form.tpl you invoke the form :

function xx(){

   //wathever your node form ID is it's an exemple
$('#node-form').submit( function() {

  $.post($(this).attr('action'), $(this).serialize(), function(response) {
  var tmp=response.match(/<div class="messages error">+[\s\S]+id="node-form"+[\s\S]+<\/form>/g);

     if(tmp){
      //wathever
     }
     else{
     //anything
     }     

  });
  return false;   // for somewath reason it is important not to be redirected to pass through ....
});
}

If we send "$(this).serialize()" as object "this" without serialize it for AJAX, no problems the rules will be listen for that form ... Else(like above) it will be pass and user can send anything ... Well even without JS included, knowing the flaw, anyone with minimal knowledge could possibly pass through the Rules form process without major problems ...

Ps : thanks you for your work ... Alex.