- Patch #671184 by Scott Reynolds, sun, effulgentsia, yched, rfay, Pasqualle: AJAX form can submit inappropriately to system/ajax after failed validation.

2 files changed, 58 insertions, 1 deletions

diff --git a/modules/file/file.module b/modules/file/file.module
index 84a006dd6..b3153e647 100644
--- a/modules/file/file.module
+++ b/modules/file/file.module
@@ -239,7 +239,7 @@ function file_ajax_upload() {
 
   // This call recreates the form relying solely on the form_state that the
   // drupal_process_form() set up.
-  $form = drupal_rebuild_form($form_id, $form_state, $form_build_id);
+  $form = drupal_rebuild_form($form_id, $form_state, $form);
 
   // Retrieve the element to be rendered.
   foreach ($form_parents as $parent) {
diff --git a/modules/simpletest/tests/form.test b/modules/simpletest/tests/form.test
index 76a9589bf..60523f0a0 100644
--- a/modules/simpletest/tests/form.test
+++ b/modules/simpletest/tests/form.test
@@ -783,6 +783,63 @@ class FormsRebuildTestCase extends DrupalWebTestCase {
     $this->assertNoFieldChecked('edit-checkbox-2-default-off', t('A newly added checkbox was initialized with a default unchecked state.'));
     $this->assertFieldById('edit-text-2', 'DEFAULT 2', t('A newly added textfield was initialized with its default value.'));
   }
+
+  /**
+   * Tests that a form's action is retained after an AJAX submission.
+   *
+   * The 'action' attribute of a form should not change after an AJAX submission
+   * followed by a non-AJAX submission, which triggers a validation error.
+   */
+  function testPreserveFormActionAfterAJAX() {
+    // Create a multi-valued field for 'page' nodes to use for AJAX testing.
+    $field_name = 'field_ajax_test';
+    $field = array(
+      'field_name' => $field_name,
+      'type' => 'text',
+      'cardinality' => FIELD_CARDINALITY_UNLIMITED,
+    );
+    field_create_field($field);
+    $instance = array(
+      'field_name' => $field_name,
+      'entity_type' => 'node',
+      'bundle' => 'page',
+    );
+    field_create_instance($instance);
+
+    // Log in a user who can create 'page' nodes.
+    $this->web_user = $this->drupalCreateUser(array('create page content'));
+    $this->drupalLogin($this->web_user);
+
+    // Get the form for adding a 'page' node. Save the content in a local
+    // variable, because drupalPostAJAX() will replace $this->content.
+    $this->drupalGet('node/add/page');
+    $content = $this->content;
+
+    // Submit an "add another item" AJAX submission and verify it worked by
+    // ensuring it returned two text fields.
+    $commands = $this->drupalPostAJAX(NULL, array(), array('field_ajax_test_add_more' => t('Add another item')));
+    $fragment = simplexml_load_string('<div>' . $commands[1]['data'] . '</div>');
+    $this->assert(count($fragment->xpath('//input[@type="text"]')) == 2, t('AJAX submission succeeded.'));
+
+    // Submit the form with the non-AJAX "Save" button. Leave the title field
+    // blank to trigger a validation error. Restore $this->content first, as
+    // drupalPost() needs that to contain the form, not the JSON string left by
+    // drupalPostAJAX().
+    // @todo While not necessary for this test, we would be emulating the
+    //   browser better by calling drupalPost() with the AJAX-modified content
+    //   rather than with the original content from the drupalGet(), but that's
+    //   not possible with the current implementation of drupalPostAJAX(). See
+    //   http://drupal.org/node/384992
+    $this->drupalSetContent($content);
+    $this->drupalPost(NULL, array(), t('Save'));
+
+    // Ensure that a validation error occurred, since this test is for testing
+    // what happens to the form action after a validation error.
+    $this->assertText('Title field is required.', t('Non-AJAX submission correctly triggered a validation error.'));
+
+    // Ensure that the form's action is correct.
+    $this->assertFieldByXPath('//form[@id="page-node-form" and @action="' . url('node/add/page') . '"]', NULL, t('Re-rendered form contains the correct action value.'));
+  }
 }
 
 /**