Extend Drupal 6 "form_token" & "form_build_id"

Question

I'm posting in my website by using command line.

Below codes works just fine for me

curl -b cookies.txt -d title="$(my-own-sed-command)" -d taxonomy%5Btags%5D%5B1%5D="$(my-own-sed-command)" -d teaser_include=1 -d body="$(my-own-sed-command)" -d field_source%5B0%5D%5Burl%5D="$(my-own-sed-command)" -d changed= -d form_build_id=form-2bef00e4e4c6c53c1cedfc61e857186b -d form_token=883b4e7f69cdd1bf3311854732eff3f7 -d form_id=post_node_form -d op=Save http://www.mywebsite.com/node/add/post

Usually I will post several times a day using above command. But the problem is; sometime I will take a rest for 2 or 3 days. After 2 or 3 days, the "form_token" & "form_build_id" has expired.

In order to prevent expiration, how to extend the "form_token" and "form_build_id" to become 7 days?

Any ways are welcome; hacking the core, disable token for this node type submission, etc.

Answer 1

TL;DR: Those values will not expire if

• you use the same user to log in to the site
• the PHP session is not expired
• Drupal finds in its cache the form array associated with "form_build_id."

The token used for "form_token" is the one created using with the following function call: drupal_get_token($form['#token']); the only value that changes in that function call, for the same form, is session_id() which is invoked from drupal_get_token().

function drupal_get_token($value = '') {
  $private_key = drupal_get_private_key();
  return md5(session_id() . $value . $private_key);
}

The value returned from drupal_get_private_key() is unique for each Drupal site; the only way to make it change is to delete the Drupal variable "drupal_private_key" that is never deleted (if there isn't a third-party module that delete it), but it is initialized when Drupal is installed. The value returned by session_id() is the same each time drupal_get_token() is called, if the logged in user is the same, and the PHP session has not yet expired.

As for the value of "form_build_id," its value is totally random, initialized from drupal_prepare_form() using the following code:

  if (isset($form['#build_id'])) {
    $form['form_build_id'] = array(
      '#type' => 'hidden', 
      '#value' => $form['#build_id'], 
      '#id' => $form['#build_id'], 
      '#name' => 'form_build_id',
    );
  }

$form['#build_id'] is initialized from the following code in drupal_get_form():

  $form_build_id = 'form-' . md5(uniqid(mt_rand(), TRUE));
  $form['#build_id'] = $form_build_id;

As you are passing the value of "form_build_id," and "form_id" in the POST data, then the following code is executed (see drupal_get_form()):

if (isset($_POST['form_id']) && $_POST['form_id'] == $form_id && !empty($_POST['form_build_id'])) {
  $form = form_get_cache($_POST['form_build_id'], $form_state);
}

If the cache contains the form, then "form_build_id" is not generated again.