--- a/web/form.py	Wed Apr 29 08:57:50 2009 +0200
+++ b/web/form.py	Wed Apr 29 08:58:41 2009 +0200
@@ -58,13 +58,22 @@
             self.req.set_page_data('rql_varmaker', varmaker)
         self.varmaker = varmaker
 
+    def session_key(self):
+        """return the key that may be used to store / retreive data about a
+        previous post which failed because of a validation error
+        """
+        return '%s#%s' % (self.req.url(), self.domid)
+
     def __init__(self, req, rset, **kwargs):
         super(FormMixIn, self).__init__(req, rset, **kwargs)
+        self.restore_previous_post(self.session_key())
+
+    def restore_previous_post(self, sessionkey):
         # get validation session data which may have been previously set.
         # deleting validation errors here breaks form reloading (errors are
         # no more available), they have to be deleted by application's publish
         # method on successful commit
-        forminfo = req.get_session_data(req.url())
+        forminfo = self.req.get_session_data(sessionkey, pop=True)
         if forminfo:
             req.data['formvalues'] = forminfo['values']
             req.data['formerrors'] = errex = forminfo['errors']
@@ -240,7 +249,7 @@
                 assert hasattr(self.__class__, key) and not key[0] == '_', key
                 setattr(self, key, val)
         if self.set_error_url:
-            self.form_add_hidden('__errorurl', req.url())
+            self.form_add_hidden('__errorurl', self.session_key())
         if self.copy_nav_params:
             for param in NAV_FORM_PARAMETERS:
                 if not param in kwargs:
@@ -250,6 +259,8 @@
         if submitmsg is not None:
             self.form_add_hidden('__message', submitmsg)
         self.context = None
+        if 'domid' in kwargs:# session key changed
+            self.restore_previous_post(self.session_key())
 
     @iclassmethod
     def field_by_name(cls_or_self, name, role='subject'):

--- a/web/views/management.py	Wed Apr 29 08:57:50 2009 +0200
+++ b/web/views/management.py	Wed Apr 29 08:58:41 2009 +0200
@@ -62,6 +62,7 @@
                 return True
         return False
 
+
 class SecurityManagementView(EntityView, SecurityViewMixIn):
     """display security information for a given entity"""
     id = 'security'
@@ -100,6 +101,7 @@
         msg = self.req._('ownerships have been changed')
         form = EntityFieldsForm(self.req, None, entity=entity, submitmsg=msg,
                                 form_buttons=[formwidgets.SubmitButton()],
+                                domid='ownership%s' % entity.eid,
                                 __redirectvid='security',
                                 __redirectpath=entity.rest_path())
         field = guess_field(entity.e_schema, self.schema.rschema('owned_by'))
@@ -156,6 +158,7 @@
         w(u'<p>%s</p>' % _('add a new permission'))
         form = EntityFieldsForm(self.req, None, entity=newperm,
                                 form_buttons=[formwidgets.SubmitButton()],
+                                domid='reqperm%s' % entity.eid,
                                 __redirectvid='security',
                                 __redirectpath=entity.rest_path())
         form.form_add_hidden('require_permission', entity.eid, role='object', eidparam=True)