Permalink
Browse files

Fix multiple selects always failing post validation.

Fixes #3218
  • Loading branch information...
1 parent 88f5a7a commit 5d830d7adb449becfd4aae45a7e623d576e141ea @markstory markstory committed Sep 18, 2012
Showing with 20 additions and 1 deletion.
  1. +17 −0 lib/Cake/Test/Case/View/Helper/FormHelperTest.php
  2. +3 −1 lib/Cake/View/Helper/FormHelper.php
@@ -4256,6 +4256,23 @@ public function testSelectMultipleCheckboxSecurity() {
}
/**
+ * Multiple select elements should always be secured as they always participate
+ * in the POST data.
+ *
+ * @return void
+ */
+ public function testSelectMultipleSecureWithNoOptions() {
+ $this->Form->request['_Token'] = array('key' => 'testkey');
+ $this->assertEquals(array(), $this->Form->fields);
+
+ $result = $this->Form->select(
+ 'Model.select',
+ array(),
+ array('multiple' => true)
+ );
+ $this->assertEquals(array('Model.select'), $this->Form->fields);
+ }
+/**
* When a select box has no options it should not be added to the fields list
* as it always fail post validation.
*
@@ -1850,10 +1850,12 @@ public function select($fieldName, $options = array(), $attributes = array()) {
if (!empty($tag) || isset($template)) {
$hasOptions = (count($options) > 0 || $showEmpty);
+ // Secure the field if there are options, or its a multi select.
+ // Single selects with no options don't submit, but multiselects do.
if (
(!isset($secure) || $secure == true) &&
empty($attributes['disabled']) &&
- $hasOptions
+ (!empty($attributes['multiple']) || $hasOptions)
) {
$this->_secure(true);
}

0 comments on commit 5d830d7

Please sign in to comment.