How can I protect a disabled form from being submitted?

Question

I need to protect URL alias from being submitted.

I've tried setting #disabled, #access, unset(), and what not. It hides the form, but the user is still able to modify the form on the client-side and submit it.

How do I prevent this form from being submitted on the client-side?

My current module code

<?php
function mymodule_form_alter(&$form, &$form_state){
  if (empty($form['type']['#value'])) return;
  $form['#after_build'][] = 'mymodule_after_built';
}

function mymodule_after_built($form, &$form_state) {
  $form['path']['#access'] = FALSE;
  $form['path']['alias']['#access'] = FALSE;
  $form['path']['alias']['#value'] = $form['path']['alias']['#default_value'];

  return ($form);
}

UPDATE:

To clear the question, I am not asking how to hide the form, but how to prevent the end-user from manually altering the code and submitting the form I just hid.

End-user can just edit source code and add <input type="text" id="edit-path-alias" name="path[alias]" value="" size="60" maxlength="255" class="form-text"> and still enter the alias.

Answer 1

Found the issue! It seems to be a Drupal bug.

#access set in #after_build does not completely override the #access settings, set in hook_form_alter.

In theory, a form is altered by hook_form_alter and hook_form_alter is altered by #after-build. When I try setting #access in hook_form_alter, to alter the form, everything works. However, when I try setting #access permissions in #after_build, to alter hook_form_alter, it only hides the form, still allowing anyone to submit it, by altering the code on the client side.

As a temporary solution, I disabled URL alias permissions, by unchecking "Administer URL aliases" and "Create and edit URL aliases".

Answer 2

If you set #access to FALSE in #after_build callback, the value will not be submitted even if it's sent to server.