- Patch #28420 by Jeremy: provide a more generic interface that can be used

  to validate other form submissions, not just comments. Two new functions
  are introduced, form_token() and form_validate(). The first function uses
  a private key and a public key to set a token in a hidden field. The second
  function validates the token. The comment and contect module are updated to
  use these functions.

1 files changed, 5 insertions, 0 deletions

diff --git a/modules/comment/comment.module b/modules/comment/comment.module
index 261743094..d441bd6d9 100644
--- a/modules/comment/comment.module
+++ b/modules/comment/comment.module
@@ -519,6 +519,9 @@ function comment_validate($edit) {
       }
     }
   }
+  // verify that this submission was actually generated using a local form
+  form_validate($edit, 'comment'. $edit['nid'] . $edit['pid']);
+
   return $edit;
 }
 
@@ -1426,6 +1429,8 @@ function theme_comment_form($edit, $title = NULL) {
   $form .= form_hidden('pid', $edit['pid']);
   $form .= form_hidden('nid', $edit['nid']);
   $form .= form_hidden('uid', $edit['uid']);
+  // generate a token used to validate that submissions came from this form
+  $form .= form_token('comment'. $edit['nid'] . $edit['pid']);
 
   $form .= form_submit(t('Preview comment'));