input with attribute 'disabled'=>$someArrayValue causes Auth Security Error

[asgraf]

When you enable SecurityComponent

This line work perfectly:

echo $this->Form->input('avatar_from',array('type'=>'radio','values'=>array('Gravatar'=>'Gravatar','Facebook'=>'Facebook','Google'=>'Google','Twitter'=>'Twitter')));

This line causes Auth Security error:

echo $this->Form->input('avatar_from',array('type'=>'radio','values'=>array('Gravatar'=>'Gravatar','Facebook'=>'Facebook','Google'=>'Google','Twitter'=>'Twitter'),'disabled'=>array('Facebook','Google')));

Tested on CakePHP 2.6.0

[markstory]

Is the selected value one of the disabled options?

[asgraf]

I did some testing.
I have added following line to FormHelper:

debug($hashParts[1]);//added in FormHelper

Test code 1:

echo $this->Form->create('User');
$this->Form->input('testing',array('options'=>array(1,2,3)));
echo $this->Form->end();

debug output for test1:

'a:1:{i:0;s:12:"User.testing";}'

Test code 2:

echo $this->Form->create('User');
$this->Form->input('testing',array('options'=>array(1,2,3),'disabled'=>array(2,3)));
echo $this->Form->end();

debug output for test2:

'a:0:{}'

My quick investigation shows that existence of 'disabled'=>$nonEmptyArray causes field to be skipped in $hashParts[1] in FormHelper so it will generate different hash than SecurityComponent

[markstory]

Any non-empty disabled set will exclude the input as the helpers make the assumption that a disabled input includes all options. A similar edge case will be present for select boxes as well.

[markstory]

Pull request up now.