Change record status: 
Project: 
Introduced in branch: 
7.x
Introduced in version: 
7.27
Description: 

Starting in Drupal 7.27, the form_set_cache() API function now validates that the passed in $form_build_id parameter (which is used to construct the cache key) actually matches the form build ID associated with the form. (The form build ID associated with the form is stored in $form['#build_id'].) If it does not match, then for security reasons the form will not be cached.

Although form_set_cache() is technically a public API function, it is rarely called outside of the Drupal core form API. If your code is calling this function, consider whether you still need to (for example, older Ajax code ported from Drupal 6 might be calling this function in Drupal 7 even though it is unnecessary) and if you do, make sure that you are passing in $form['#build_id'] as the first parameter.

Impacts: 
Module developers