If a form is to be posted to some external url (like paypal.com) then there is no point in having fields for form_build_id, form_id and form_token as only the original form will be able to utilise them.

With this patch, if #action is customised then these fields are omitted.

CommentFileSizeAuthor
external-form.patch1.59 KBjbrown

Comments

jbrown’s picture

jbrown commented

Any thoughts on this?

jbrown’s picture

jbrown commented

external-form.patch queued for re-testing.

Stewx’s picture

Stewx commented

Any more info on this?

hibersh’s picture

hibersh commented
Status: Needs review » Fixed

http://api.drupal.org/api/drupal/includes--form.inc/function/form_state_...

jbrown’s picture

jbrown commented
Version: 7.x-dev » 8.x-dev
Status: Fixed » Needs review

That's totally different - I want form_build_id, form_id and form_token to be absent from the HTML for forms that are not going to be submitted back to Drupal.

The function you mention above is for cleaning these values from a form_state once the form has been submitted.

jbrown’s picture

jbrown commented

external-form.patch queued for re-testing.

Status: Needs review » Needs work

The last submitted patch, external-form.patch, failed testing.

glennpratt’s picture

glennpratt commented 
+++ includes/form.inc	8 Jun 2010 17:43:43 -0000
@@ -730,7 +733,7 @@
     // Form constructors may explicitly set #token to FALSE when cross site
     // request forgery is irrelevant to the form, such as search forms.
     if (isset($form['#token']) && $form['#token'] === FALSE) {

Why not tie the removal to this conditional?

Overloading on #action may not be what the user intended, but setting #token to FALSE is pretty clear.

Chris Gillis’s picture

Chris Gillis commented

I need to do precisely that on a Drupal 7 site. Anyone have feedback on a workaround I can use that doesn't require a patch of core?

Chris Gillis’s picture

Chris Gillis commented

Workaround:

 $form['#after_build'][] = 'mymodule_form_modify';

function mymodule_form_modify($form){
  unset($form['form_token']);
  unset($form['form_build_id']);
  unset($form['form_id']);
  return $form;
}

and to get rid of "op":

   $form['submit'] = array(
      '#type' => 'submit',
      '#value' => 'Make Payment',
      '#name' => '',
  );
wouters_f’s picture

wouters_f commented

a little off topic, (drupal 7)
To remove the form_id and form_build_id from the form to external url's "#after_build" did not do it for me.
"#pre_render" did the trick (drupal 7).

$form['#pre_render'][] = 'mymodule_form_modify'
sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Status: Needs work » Closed (won't fix)

If you have this special use-case, then you can set those internal/hidden form elements to #printed TRUE or #access FALSE.

A customized #action does not automatically mean that the form does not submit to Drupal anymore.

ankithashetty’s picture

ankithashetty
Location Karnataka, India
commented
Issue summary: View changes

If I unset the form_id I get an error 

The website encountered an unexpected error. Please try again later.
Drupal\Core\Database\IntegrityConstraintViolationException: SQLSTATE[23000]: Integrity constraint violation: 1048 Column 'form_id' cannot be null: INSERT INTO {captcha_sessions} ("uid", "sid", "ip_address", "timestamp", "form_id", "solution", "status", "attempts") VALUES (:db_insert_placeholder_0, :db_insert_placeholder_1, :db_insert_placeholder_2, :db_insert_placeholder_3, :db_insert_placeholder_4, :db_insert_placeholder_5, :db_insert_placeholder_6, :db_insert_placeholder_7); Array ( [:db_insert_placeholder_0] => 0 [:db_insert_placeholder_1] => JaowbiUyabOJ_K8B0Jc93oE3vlpzGeWqMBRt-buExWU [:db_insert_placeholder_2] => 172.20.0.2 [:db_insert_placeholder_3] => 1607576058 [:db_insert_placeholder_4] => [:db_insert_placeholder_5] => 9bea9ccb65690fac75cba56d01381e300bf9f31b7b68ea1172e71e8a7840d1a1 [:db_insert_placeholder_6] => 0 [:db_insert_placeholder_7] => 0 ) in Drupal\Core\Database\Connection->handleQueryException() (line 802 of core/lib/Drupal/Core/Database/Connection.php).