I’m refactoring a CMS I build. The CMS has the ability to edit pages based on the chosen locale. I keep this chosen locale in a session while the user of the CMS browses through pages they like to edit.
Now, my question is:
If a user is editing a page and wants to submit changes, do you feel that I should include the locale as a hidden field in the form that is to be submitted? Just to be on the safe side? Or should I just rely on the locale that is present in the session?
Yes, you should absolutely post it along every time, because the user could have changed the locale while editing the page. The result would be that a page gets overwritten with the contents from a different locale.
If the user is not allowed to edit pages outside their locale, you will have to additionally check whether the user is allowed to edit the page/locale combination specified (because they could fake it when it comes through a session).