{"action":"created","issue":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/6367","labels_url":"https://api.github.com/repos/cakephp/cakephp/issues/6367/labels{/name}","comments_url":"https://api.github.com/repos/cakephp/cakephp/issues/6367/comments","events_url":"https://api.github.com/repos/cakephp/cakephp/issues/6367/events","html_url":"https://github.com/cakephp/cakephp/issues/6367","id":69438492,"number":6367,"title":"[3.0.1] buildRules with conditions","user":{"login":"codercms","id":4526911,"avatar_url":"https://avatars.githubusercontent.com/u/4526911?v=3","gravatar_id":"","url":"https://api.github.com/users/codercms","html_url":"https://github.com/codercms","followers_url":"https://api.github.com/users/codercms/followers","following_url":"https://api.github.com/users/codercms/following{/other_user}","gists_url":"https://api.github.com/users/codercms/gists{/gist_id}","starred_url":"https://api.github.com/users/codercms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/codercms/subscriptions","organizations_url":"https://api.github.com/users/codercms/orgs","repos_url":"https://api.github.com/users/codercms/repos","events_url":"https://api.github.com/users/codercms/events{/privacy}","received_events_url":"https://api.github.com/users/codercms/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-19T16:06:37Z","updated_at":"2015-04-19T16:14:09Z","closed_at":"2015-04-19T16:14:09Z","body":"Hi! I have a problem with buildRules.\r\nMy model's code:\r\n```\r\n/**\r\n * Orders Model\r\n */\r\nclass OrdersTable extends Table\r\n{\r\n\r\n    /**\r\n     * Initialize method\r\n     *\r\n     * @param array $config The configuration for the Table.\r\n     * @return void\r\n     */\r\n    public function initialize(array $config)\r\n    {\r\n        $this->table('orders');\r\n        $this->displayField('id');\r\n        $this->primaryKey('id');\r\n        $this->belongsTo('Users', [\r\n            'foreignKey' => 'customer_id',\r\n            'joinType' => 'INNER'\r\n        ]);\r\n\r\n        $this->belongsTo('Performers', [\r\n            'className' => 'Users',\r\n            'foreignKey' => 'performer_id',\r\n            'joinType' => 'INNER',\r\n            'conditions' => ['Performers.group_id' => 2]\r\n        ]);\r\n\r\n        $this->hasMany('OrderComments', [\r\n            'foreignKey' => 'order_id'\r\n        ]);\r\n    }\r\n\r\n    /**\r\n     * Default validation rules.\r\n     *\r\n     * @param \\Cake\\Validation\\Validator $validator Validator instance.\r\n     * @return \\Cake\\Validation\\Validator\r\n     */\r\n    public function validationDefault(Validator $validator)\r\n    {\r\n        $validator\r\n            ->add('id', 'valid', ['rule' => 'numeric'])\r\n            ->allowEmpty('id', 'create')\r\n\r\n            ->add('customer_id', 'valid', ['rule' => 'numeric'])\r\n\r\n            ->add('performer_id', 'valid', ['rule' => 'numeric'])\r\n\r\n            ->add('type', 'inList', ['rule' => ['inList', [\r\n                'type1',\r\n                'type2',\r\n                'type3']\r\n            ]])\r\n            ->requirePresence('type', 'create')\r\n            ->notEmpty('type')\r\n\r\n            ->add('status', 'inList', ['rule' => ['inList', [\r\n                'state1',\r\n                'state2',\r\n                'state3',\r\n                'state4',\r\n                'state5']\r\n            ]])\r\n            ->requirePresence('status', 'create')\r\n            ->notEmpty('status')\r\n\r\n            ->add('amount', 'valid', ['rule' => 'numeric'])\r\n            ->requirePresence('amount', 'create')\r\n\r\n            ->notEmpty('amount')\r\n\r\n            ->requirePresence('data', 'create')\r\n            ->notEmpty('data')\r\n            ->requirePresence('cr_time', 'create')\r\n\r\n            ->notEmpty('cr_time');\r\n\r\n        return $validator;\r\n    }\r\n\r\n    /**\r\n     * Returns a rules checker object that will be used for validating\r\n     * application integrity.\r\n     *\r\n     * @param \\Cake\\ORM\\RulesChecker $rules The rules object to be modified.\r\n     * @return \\Cake\\ORM\\RulesChecker\r\n     */\r\n    public function buildRules(RulesChecker $rules)\r\n    {\r\n        $rules->add($rules->existsIn(['customer_id'], 'Users'));\r\n        $rules->add($rules->existsIn(['performer_id'], 'Performers'));\r\n\r\n        return $rules;\r\n    }\r\n}\r\n```\r\n\r\nThe actually problem with that rule -\r\n```\r\n$rules->add($rules->existsIn(['performer_id'], 'Performers'));\r\n```\r\nThat rule is ignoring the following condition - ```Performers.group_id' => 2```\r\n\r\nSaving code:\r\n```\r\n    public function add()\r\n    {\r\n        $order = $this->Orders->newEntity();\r\n        if ($this->request->is('post')) {\r\n            $order = $this->Orders->patchEntity($order, $this->request->data);\r\n            if ($this->Orders->save($order)) {\r\n                $this->Flash->success('The order has been saved.');\r\n                return $this->redirect(['action' => 'index']);\r\n            } else {\r\n                $this->Flash->error('The order could not be saved. Please, try again.');\r\n            }\r\n        }\r\n        $users = $this->Orders->Users->find('list', ['limit' => 200]);\r\n        $performers = $this->Orders->Performers->find('list', ['limit' => 200]);\r\n\r\n        $this->set(compact('order', 'users', 'performers'));\r\n    }\r\n```\r\n\r\nBy using form spoofing i can make a user not from group with id 2 as orders performer\r\nIs there any way to fix it?"},"comment":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/comments/94291524","html_url":"https://github.com/cakephp/cakephp/issues/6367#issuecomment-94291524","issue_url":"https://api.github.com/repos/cakephp/cakephp/issues/6367","id":94291524,"user":{"login":"ADmad","id":142658,"avatar_url":"https://avatars.githubusercontent.com/u/142658?v=3","gravatar_id":"","url":"https://api.github.com/users/ADmad","html_url":"https://github.com/ADmad","followers_url":"https://api.github.com/users/ADmad/followers","following_url":"https://api.github.com/users/ADmad/following{/other_user}","gists_url":"https://api.github.com/users/ADmad/gists{/gist_id}","starred_url":"https://api.github.com/users/ADmad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ADmad/subscriptions","organizations_url":"https://api.github.com/users/ADmad/orgs","repos_url":"https://api.github.com/users/ADmad/repos","events_url":"https://api.github.com/users/ADmad/events{/privacy}","received_events_url":"https://api.github.com/users/ADmad/received_events","type":"User","site_admin":false},"created_at":"2015-04-19T16:14:09Z","updated_at":"2015-04-19T16:14:09Z","body":"> That rule is ignoring the following condition - Performers.group_id' => 2\r\n\r\nApplication rules don't take model associations into account.\r\n\r\n> By using form spoofing i can make a user not from group with id 2 as orders performer\r\nIs there any way to fix it?\r\n\r\nYes. Use `SecurityComponent` and your form can't be tempered."}}