Drupal 7 Module Development

Chapter 8
Handling AJAX callbacks securely
Drupal 7 comes with an enhanced AJAX framework that makes it easy to build
interactive display elements for pages and forms. The security problem for Drupal
is that AJAX callbacks take the form of menu callbacks, which unlike most Drupal
forms, are essentially GET requests to the browser. This fact means that any request
to an AJAX callback must be treated as malicious and that all such requests must be
tested for validity before an AJAX response can be sent.
Using AJAX in forms
When using the #ajax element with the Forms API, Drupal automatically secures
the AJAX callback by checking the validity of the form request. This action only
works, of course, if you follow the FormsAPI correctly. Using the #ajax form
element triggers the ajax_get_form() function, which uses form_build_id to test
for validity:
function ajax_get_form() {
$form_state = form_state_defaults();
$form_build_id = $_POST['form_build_id'];
// Get the form from the cache.
$form = form_get_cache($form_build_id, $form_state);
if (!$form) {
// If $form cannot be loaded from the cache, the form_build_id
// in $_POST must be invalid, which means that someone
// performed a POST request onto system/ajax without actually
// viewing the concerned form in the browser.
// This is likely a hacking attempt as it never happens under
// normal circumstances, so we just do nothing.
watchdog('ajax', 'Invalid form POST data.', array(),
WATCHDOG_WARNING);
drupal_exit();
}
// ...
As we saw in the preceding section that form_build_id ensured that the form
request was issued by the Drupal site and was valid.
[ 235 ]