[Form] `required` attribute is set on all form fields regardless of whether they are required or not

[oscherler]

Build a form from a form type class:

public function buildForm( FormBuilder $builder, array $options )
{
    $builder
        ->add( 'text', 'text', array(
            'label' => 'search.form.text.label'
        ) )
        ->add( 'date', 'date', array(
            'widget' => 'single_text',
            'format' => 'dd.MM.yyyy',
            'label' => 'search.form.date.label'
        ) );
}

Add basic validation rules where none of the fields are required:

Me\MyBundle\Form\Model\TextSearch:
  properties:
    date:
      - Type: \DateTime

Render the form:

<form method="post" {{ form_enctype( form ) }}>
    {{ form_widget( form ) }}
    <input type="submit" value="Search" />
</form>

All the fields get a required attribute:

<label for="text_search_text" class=" required">Text</label>
<input type="text" id="text_search_text" name="text_search[text]" required="required" value="" />

This is incorrect, since the validation rules state that they are not required.

Under Forms (2.0) – Form Validation, the documentation states:

HTML5 Validation
As of HTML5, many browsers can natively enforce certain validation constraints on the client side. The most common validation is activated by rendering a required attribute on fields that are required. […]
Generated forms take full advantage of this new feature by adding sensible HTML attributes that trigger the validation.

This is clearly not the case: all the fields get the required attribute.

Also, under Built-in Field Types – Field Type Options (i.e. not under Form Validation), one can read:

The required option
The most common option is the required option, which can be applied to any field. By default, the required option is set to true, meaning that HTML5-ready browsers will apply client-side validation if the field is left blank.

In other words, Symfony is artificially introducing a discrepancy between the client- and the server-side validation criteria, and this by default.

Moreover, there is a conflict between the two cited paragraphs of the documentation. The first one states that the required attribute is rendered on fields that are required, which is confirmed by the following paragraph under Field Type Guessing – Field Type Options Guessing:

required: The required option can be guessed based off of the validation rules (i.e. is the field NotBlank or NotNull) or the Doctrine metadata (i.e. is the field nullable). This is very useful, as your client-side validation will automatically match your validation rules.

However, the second paragraph states that the required option is set to true by default.

Resolution

1. The documentation should be corrected for consistency: under Built-in Field Types – Field Type Options:

   By default, the required option is set to true on the fields that are guessed to be required based on the validation rules, meaning that HTML5-ready browsers will apply client-side validation if the field is left blank.

2. Symfony’s behaviour should be changed to match the documentation: the required option should be set based on the guessed value and not to true by default.

[stof]

There is no inconsistency in the doc: the first place tells that the HTML5 required attribute is rendered when the field is required (i.e. when the required option is set to true) and the second place tells you that the default value of this option is true. I don't see how it could be conflict as it concerns 2 different things.

[oscherler]

OK, then let’s focus on fixing the behaviour, and then update the documentation to reflect it. required should not be true by default because it introcuces the aforementioned client-side/server-side discrepancy, whereas setting it to false doesn’t break anything. From the documentation:

In other words, the required option is "nice", but true server-side validation should always be used.

[mvrhov]

setting required to false so late would be a huge and by huge I mean giant BC break.

[webmozart]

@mvrhov The change is not that giant. @oscherler only talks about cases were a class was annotated with validation constraints and fields that did not have a Not[Null|Blank] constraints were still set to required by default, leaving the "required" attribute in the browser. Server-side validation did not happen, so on browsers < HTML5 you don't even notice the difference after fixing this.

[kevou84]

I fear this behaviour is back... I'm having required field by default EVEN with required => false set in some case (ie repeated password). Again, I have all my fields set to required even if no assert annotation exists. See my e-mail this morning on SF2 ML called "Forms&validators / Capricious required option ?". thanks for your reply.

[mlwacosmos]

I am using symfony 2.2 and it looks like bschussek solution has been implemented in this version but the problem remains !!

[tayhimself]

@mlwacosmos I'm having the same issue as well on 2.2 using Propel (and therefore not using annotations). All fields are required by default.

[dnohales]

Actually, the problem still exist. Symfony does not try to guess the form options when does not need to guess the form type, check FormBuilder::create. As you can see, if Symfony knows the type, doesn't create the form using FormFactory::createBuilderForProperty, that, as you also can see, is the only method that call the guesser chain to guess not only the type but some form options, including the required option.

You can easily reproduce the bug, just create an entity with this field like this:

...
/**
 * @ORM\Column(type="string", length=64, nullable=true)
 */
private $name;
...

Now let's create a form for this entity, if you create the field without specifying the type:

$builder->add('name', null);

Symfony guess that the required options must be false and maxlength must be 64. But if you create the field specifying the type:

$builder->add('name', 'text');

Symfony doesn't guess the required nor maxlength values and it just uses the default values.

This also apply if we change the constraints for the field since {Propel,DoctrineOrm}TypeGuesser and ValidatorTypeGuesser are both in the guesser chain.

[Tobion]

@eagleoneraptor This is on purpose, so guessing can be deactivated. Otherwise guessing might add things suddenly you don't want.
The bigger problem is that required defaults to true which I already said in #3821 (comment)

[Tobion]

See also #5365

[InternalServerError]

Hi there,
I'm using Symfony 2.5 and I've the same issue.
Indeed, I'm trying to setting the "required" value from true to false when I'm on an edit form with an addEventListener.
Unfortunately, I do not any success with it :

class UserType extends AbstractType
{
    public function buildForm(FormBuilderInterface $builder, array $options)
    {
        $builder
            ->add('firstname', null, array('label' => 'form.user.firstname', 'required' => true, 'trim' => true) )
            ->add('lastname', null, array('label' => 'form.user.lastname', 'required' => true, 'trim' => true) )
            ->add('username', null, array('label' => 'form.user.username', 'required' => true, 'trim' => true) )
            ->add('email', null, array('label' => 'form.user.email', 'required' => true, 'trim' => true))
            ->add('roles', 'collection', array(
                    'type' => 'choice',
                    'options' => array(
                        'label' => false,
                        'choices' => array('ROLE_USER' => 'User', 'ROLE_ADMIN' => 'Administrator')
                    ),
            ));

        $builder->addEventListener(FormEvents::PRE_SET_DATA, function(FormEvent $event) {
            $user = $event->getData();
            $form = $event->getForm();

            if (!$user || null === $user->getId()) {
                $form->add('password', 'repeated', array(
                    'type' => 'password',
                    'invalid_message' => 'form.user.password.repeat',
                    'options' => array('required' => true),
                    'first_options'  => array('label' => 'form.user.password'),
                    'second_options' => array('label' => 'form.user.password.confirm'),
                ));
            } else {
                $form->add('password', 'repeated', array(
                    'type' => 'password',
                    'invalid_message' => 'form.user.password.repeat',
                    'options' => array('required' => false),
                    'first_options'  => array('label' => 'form.user.password', 'required' => false),
                    'second_options' => array('label' => 'form.user.password.confirm', 'required' => false),
                ));
            }
        });
    }

The executed code is well the "else" case, but the fields are still required.

Is something which can be done for fix it please ?

Thanks.