Modules which provide alternative page cache implementations require updates for Drupal 6.31 and Drupal 7.27

Some contributed modules provide alternative page cache implementations. Those often require administrators to disable the built-in page cache for anonymous users, such that it does not interfere with the page cache the module provides.

Any module which caches pages under different conditions than Drupal core will require updates to provide full compatibility with the security fixes included in Drupal 6.31 and Drupal 7.27. Whenever a form is going to be saved to the page cache, it must be updated with the "immutable" flag. This can be done from within hook_form_alter().

Drupal core adds this flag automatically under the following conditions:

Drupal 6:

  if (variable_get('cache', CACHE_DISABLED) != CACHE_DISABLED && !$GLOBALS['user']->uid && $_SERVER['REQUEST_METHOD'] == 'GET' && page_get_cache(TRUE)) {
    // Drupal core already adds the appropriate flag.
  }

Drupal 7:

  if (variable_get('cache', 0) && drupal_page_is_cacheable()) {
    // Drupal core already adds the appropriate flag.
  }

If your module writes to the page cache under different conditions, you must add the "immutable" flag in hook_form_alter(), as in the examples below.

Drupal 6:

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
  if (mymodule_page_will_be_cached()) {
    $form['#immutable'] = TRUE;
  }
}

Drupal 7:

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
  if (mymodule_page_will_be_cached()) {
    $form_state['build_info']['immutable'] = TRUE;
  }
}

Here it is assumed that mymodule_page_will_be_cached() is a function provided by your module that always returns TRUE or FALSE depending on whether the current page request will be written to the page cache.