Basically my question is this: what is the proper method for passing needed data through a form preview?
In my case, a user uploads an image file. I am creating a thumbnail of that image and storing it using the filemanager module. Then I can show the form preview. When the form is submitted, I need to know the file IDs of the uploaded file and the thumbnail file. I could pass those IDs as hidden fields, but a crafy user can change the IDs before he/she submits the form. I have also considered building an MD5-type hash of the file IDs to verify that the IDs did not change from preview to submit. I think keeping track of that data in $_SESSION is probably safer. Is there a proper way to do this in Drupal, or are we on our own in handling this data?
(See the comments on this bug report for background on this question.)
