CakePHP 1.26: a bug in the Security component?
For those of you who may have read this before, I did a little research and completely updated my question. I am having an issue where my form requests are getting a black line with the Security component, although everything works fine when the security component is disabled. I traced it down to one line in the form:
<?php echo $form->create('Audition');?>
<fieldset>
<legend><?php __('Edit Audition');?></legend>
<?php
echo $form->input('ensemble');
echo $form->input('position');
echo $form->input('aud_date');
// The following line works fine...
echo $form->input('owner');
// ...but the following line blackholes when Security included
// and the form is submitted:
// echo $form->input('owner', array('disabled'=>'disabled');
?>
</fieldset>
<?php echo $form->end('Submit');?>
(I have cleared the violation line for clarity). I think I am following the rules using a form helper; As far as I can tell, this is a bug in the Security component, but I know too much CakePHP n00b to know for sure. I would like some feedback and if this is a real bug, I will submit it to the CakePHP team. I would also be interested to know if I'm just crazy and something obvious here.
(sorry for the comments here, but I didn't have enough room for them in the comments)
UPDATE : Thanks Jesh you are 100% correct about this - "no input value will be sent when disabled." I even looked at the official HTML spec , which says "[Disabled element] cannot accept user input and its value will not be submitted on the form." But Cake IS delivers value with its form! When I disable the use of the security component, I can see the POST data sent with the form, and of course the owner field was submitted! Unfortunately this is exactly the behavior I wanted, but it doesn't seem to agree with the official HTML spec ... so I think this is a bug with the standard form helper. I'll report this to the CakePHP team as a bug, but I'd love to hear from everyone,who can confirm or deny it.
Also, Jesh, your idea to use a secure key and set it to false works great, but I really DO NOT WANT to leave this field unsecured (in fact, I ESPECIALLY do not want to leave this field unsecured) and it seems to me that I shouldn't do it. In fact, now I think it might also be a bug in the Security component; I'm using FormHelper to create my forms here - so the security component can't handle it?
@Miles: your solution works great - thanks! But it still leaves the same questions that I raised above.
source to share
Well, the input value won't be sent if disabled. But since you will output the field using the Cakephp FormHelper, the SecurityComponent expects the input value to be specified in an array Controller->data
, otherwise it will black out your request.
Try adding the secure
key to the form parameters array and set it to false
.
source to share