diff options
Diffstat (limited to 'includes/form.inc')
| -rw-r--r-- | includes/form.inc | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/includes/form.inc b/includes/form.inc index 8ca048a90..fcfc79653 100644 --- a/includes/form.inc +++ b/includes/form.inc @@ -462,7 +462,7 @@ function drupal_rebuild_form($form_id, &$form_state, $old_form = NULL) { $form['#build_id'] = $old_form['#build_id']; } else { - $form['#build_id'] = 'form-' . drupal_hash_base64(uniqid(mt_rand(), TRUE) . mt_rand()); + $form['#build_id'] = 'form-' . drupal_random_key(); } // #action defaults to request_uri(), but in case of Ajax and other partial @@ -977,7 +977,7 @@ function drupal_prepare_form($form_id, &$form, &$form_state) { // @see drupal_build_form() // @see drupal_rebuild_form() if (!isset($form['#build_id'])) { - $form['#build_id'] = 'form-' . drupal_hash_base64(uniqid(mt_rand(), TRUE) . mt_rand()); + $form['#build_id'] = 'form-' . drupal_random_key(); } $form['form_build_id'] = array( '#type' => 'hidden', @@ -1129,6 +1129,12 @@ function drupal_validate_form($form_id, &$form, &$form_state) { // Setting this error will cause the form to fail validation. form_set_error('form_token', t('The form has become outdated. Copy any unsaved work in the form below and then <a href="@link">reload this page</a>.', array('@link' => $url))); + + // Stop here and don't run any further validation handlers, because they + // could invoke non-safe operations which opens the door for CSRF + // vulnerabilities. + $validated_forms[$form_id] = TRUE; + return; } } |