Reference to http://drupal.org/node/451654

I followed the Issue and tracked it down to this function http://library.acquia.com/api/function/filefield_node_form_validate/6.

I changed this part

if (!empty($form_state['values'][$field_name])) {
      foreach ($form_state['values'][$field_name] as $delta => $item) {

to this code

if (!empty($form_state['clicked_button']['#post'][$field_name])) {
      foreach ($form_state['clicked_button']['#post'][$field_name] as $delta => $item) {

.

I came to this code by printing out the form_state variable and looking at it (Maybe I should add, that we are adding multiple content Profiles into one Registration Page including FileFields).

My Question is: Can you see any problems with this change? Am I far off track? Is it stupid what I am trying to do? It works for now, but did not have further testing (But will have this week for my case).

Thanks in advance for any replies.

JThan

Comments

quicksketch’s picture

quicksketch
he/him
commented

Can you see any problems with this change?

Your use of #post means that values may be spoofed and you loose the security provided by Drupal's Form API. In other words, I'd consider this change dangerous and no longer secure.

JThan’s picture

JThan commented

This means, that by using #post someone could use a bad filename which will not be checked upon? But in the mentioned function, there are just checks on if there is a value in there. There is no return including actual values of #post, and the thing done is to set a form_error. So in my opinion this is not influencing any other validation or security checks.

Please do not get me wrong. I believe you know a lot more about this than I do. I want to learn and therefore have to ask questions. Thx for your answer.

JThan

quicksketch’s picture

quicksketch
he/him
commented
Status: Active » Closed (fixed)

I don't usually help with custom coding in the issue queue. Considering the age of this request, I'm going to go ahead and close it also. I think the approach recommended in #451654: Filefield upload during registration is probably a better way to go, as Content Profile is the place where this should be addressed.