Drupal - Protect form to external action from tempering

Question

function simple_form($form_state) {
  $form['item'] = array('#type' => 'hidden', '#value' => 'some_value');
  $form['#action'] = 'http://external-website.com/';
  $form['submit'] = array(
    '#type' => 'submit',
  );
  return $form;
}

Simple Drupal form, gets called with drupal_get_form(simple_form).

Unfortunately, it is really easy to change the value of 'item' to something else in the form, and then send that value to the external site.

As far as I tried, there is no way to check the form before it leaves my site.

function simple_form_validate() and submit never get called.

How can I prevent that? Set the action to an internal function and then submit it after validating? How would I go about that?

Unfortunately, setting

$form['item'] = array('#type' => 'value', '#value' => 'some_value');

doesn't work? The external site doesn't receive the value for 'item'.

Any advice?

Answer 1

It is either/or. and that has nothing to do with Drupal, but with the nature of HTTP POST.

Either you use #type=>value and Drupal maintains its storage outside of the form, inside of Drupal, trough a session, Or you post to external, in which case that internal session storage cannot help.

Drupals security system in the Form API relies on the fact that Drupal "knows" the exact form itself and therefore can avoid incorrect values, by comparing them to the original form. An external site knows nothing about the original form, and therefore knows nothing about how to validate it.

You will need to perform validation on the end of the receiver of the POST (that external site), nothing else will be secure (enough).

That validation could be a local script running on the remote site, wich simply validates against whitelists or regular expressions. Alternatively, that remote site could request (e.g. over HTTP-SOAP, or XMLRPC) the form on the original Drupal-site, but that is going to be pretty hard to achieve.

A third alternative, and IMHO the simplest, is to let Drupal handle the entire form locally, and if validated process it in the submit hook. In there, you can either post the values to the remote site in a secure way, or you can simply stick it in the database or some spool-system of that remote site. In any case: in the submit hook, after Drupal validated the form, you push it on to the remote site.