Issue #2504139 by borisson_, Wim Leers, plach, prashantgoel, Fabianx, dawehner, David_Rothstein, effulgentsia: Blocks containing a form include the form action in the cache, so they always submit to the first URL the form was viewed at

Issue #2554233 by pwolanin, tim.plunkett, amateescu, dawehner, Wim Leers, catch, effulgentsia, larowlan, Abdullah Hussam, greggles, David_Rothstein: Port Cross-site Request Forgery - Form API fixes from SA-CORE-2015-003 to Drupal 8

Issue #2554219 by nod_, larowlan, tim.plunkett, regilero, droplet, japerry, samuel.mortenson, Pere Orga, effulgentsia, benjy, Gábor Hojtsy, greggles, Wim Leers, David_Rothstein, pwolanin, neclimdul, EclipseGc, znerol: Port Cross-site Scripting - Ajax system fixes from SA-CORE-2015-003 to Drupal 8

Issue #2504141 by alexpott, tim.plunkett, larowlan, David_Rothstein, dawehner: Information disclosure/open redirect vulnerability via blocks that contain a form

Issue #2502785 by dawehner, effulgentsia, tim.plunkett, amateescu, Fabianx, Wim Leers, catch, dsnopek, EclipseGc, yched, Berdir, larowlan, mondrake, olli: Remove support for $form_state->setCached() for GET requests

Issue #2487600 by dawehner, Wim Leers, fgm: #access should support AccessResultInterface objects or better has to always use it

Issue #2500527 by dawehner, tim.plunkett, effulgentsia: Rewrite \Drupal\file\Controller\FileWidgetAjaxController::upload() to not rely on form cache

Issue #1305882 by dawehner, nod_, Fabianx, Steven Jones, sun, nlisgo: drupal_html_id() considered harmful; remove ajax_html_ids to use GET (not POST) AJAX requests

Issue #2263569 by tim.plunkett, effulgentsia, Fabianx, dawehner, Wim Leers, larowlan: Bypass form caching by default for forms using #ajax.

Issue #2473759 by tim.plunkett, Berdir, effulgentsia: Form caches should be deleted after submission

Issue #2226621 by JeroenT, ianthomas_uk, lokapujya, pjonckiere, marcingy, LinL, Xano, rpayanm, piyuesh23: Remove usage of element_info(), element_child() and element_children(). Deprecate element_info_property()

Issue #2457887 by prateekMehta, stefan.r, rpayanm, alexpott: Use Utility\SafeMarkup class instead of Utility\String for placeholder(), checkPlain(),format() functions

Issue #2448357 by amateescu: Config entity forms need to have access to an updated entity object at all times

Issue #2407361 by cilefen, JeroenT, hussainweb, neclimdul, ircmaxell, tim.plunkett, nlisgo, Crell: Move usages of drupal_html_id() to Html::getUniqueId()

Revert "Issue #2407361 by JeroenT, cilefen, hussainweb: Move usages of drupal_html_id() to Html::getUniqueId()"

This reverts commit 85b8c837.

Issue #2407361 by JeroenT, cilefen, hussainweb: Move usages of drupal_html_id() to Html::getUniqueId()

Issue #2113243 by rpayanm, Xano, tstoeckler: Rename BaseFormIdInterface::getBaseFormID() to BaseFormIdInterface::getBaseFormId()

Issue #2226863 by cs_shadow, filijonka, joelpittet, pguillard: Update stale references to theme functions that have been converted to Twig

Issue #2368975 by damiankloip: Fixed ElementInfoManager::buildInfo() processes info data on every request.

Issue #2242749 by znerol, torotil, rszrama, larowlan, dawehner, penyaskito, tim.plunkett, sun, Damien Tournoud, David_Rothstein,  effulgentsia: Fixed Port Form API security fix SA-CORE-2014-002 to Drupal 8.

Issue #2337709 by tim.plunkett: Convert form_state_values_clean() to FormStateInterface::cleanValues().

Issue #2303673 by dawehner, damiankloip, effulgentsia, Fabianx: Implement stackphp; cleanup handlePageCache() and preHandle()

Issue #2121713 by tim.plunkett, dawehner, rteijeiro, jiv_e: Move drupal_html_id() and drupal_html_class() to Drupal\Component\Utility.

Issue #2213899 by dawehner, joelpittet: Remove global $user wherever possible (outside bootstrap and authentication) Round 2.

Issue #2309323 by Berdir, tim.plunkett: Allow #submit and #validate to be specified as methods of the form object.