{"action":"created","issue":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/7848","labels_url":"https://api.github.com/repos/cakephp/cakephp/issues/7848/labels{/name}","comments_url":"https://api.github.com/repos/cakephp/cakephp/issues/7848/comments","events_url":"https://api.github.com/repos/cakephp/cakephp/issues/7848/events","html_url":"https://github.com/cakephp/cakephp/issues/7848","id":122139019,"number":7848,"title":"Allow SecurityComponent to check fields that are optional, but must have a specific value if included","user":{"login":"Zuluru","id":514172,"avatar_url":"https://avatars.githubusercontent.com/u/514172?v=3","gravatar_id":"","url":"https://api.github.com/users/Zuluru","html_url":"https://github.com/Zuluru","followers_url":"https://api.github.com/users/Zuluru/followers","following_url":"https://api.github.com/users/Zuluru/following{/other_user}","gists_url":"https://api.github.com/users/Zuluru/gists{/gist_id}","starred_url":"https://api.github.com/users/Zuluru/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zuluru/subscriptions","organizations_url":"https://api.github.com/users/Zuluru/orgs","repos_url":"https://api.github.com/users/Zuluru/repos","events_url":"https://api.github.com/users/Zuluru/events{/privacy}","received_events_url":"https://api.github.com/users/Zuluru/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cakephp/cakephp/labels/Enhancement","name":"Enhancement","color":"bfe5bf"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/cakephp/cakephp/milestones/48","html_url":"https://github.com/cakephp/cakephp/milestones/3.2.0","labels_url":"https://api.github.com/repos/cakephp/cakephp/milestones/48/labels","id":1185432,"number":48,"title":"3.2.0","description":"Backwards compatible release for 3.x. See the [3.2 Roadmap](https://github.com/cakephp/cakephp/wiki/3.2-Roadmap).","creator":{"login":"markstory","id":24086,"avatar_url":"https://avatars.githubusercontent.com/u/24086?v=3","gravatar_id":"","url":"https://api.github.com/users/markstory","html_url":"https://github.com/markstory","followers_url":"https://api.github.com/users/markstory/followers","following_url":"https://api.github.com/users/markstory/following{/other_user}","gists_url":"https://api.github.com/users/markstory/gists{/gist_id}","starred_url":"https://api.github.com/users/markstory/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markstory/subscriptions","organizations_url":"https://api.github.com/users/markstory/orgs","repos_url":"https://api.github.com/users/markstory/repos","events_url":"https://api.github.com/users/markstory/events{/privacy}","received_events_url":"https://api.github.com/users/markstory/received_events","type":"User","site_admin":false},"open_issues":59,"closed_issues":35,"state":"open","created_at":"2015-06-29T14:41:36Z","updated_at":"2015-12-15T01:41:37Z","due_on":"2015-12-25T05:00:00Z","closed_at":null},"comments":2,"created_at":"2015-12-14T21:48:30Z","updated_at":"2015-12-15T02:08:49Z","closed_at":null,"body":"I have a number of places in my application where JavaScript on the edit page can change the list of fields that are sent. For input fields, I can just mark them as unlocked, but for hidden fields I need a way to ensure that the value doesn't change *if* the field is included. An example would be the ID of a related record that might be removed. SecurityComponent does not have a way to handle this.\r\n\r\nI could handle these situations on a case-by-case basis. Various people have posted similar questions on StackOverflow, and this seems to be the most common recommendation, but it feels like this clutters my controllers, and is not DRY.\r\n\r\nI could overload some of the key functions in FormHelper and SecurityComponent, but then I have to monitor each of those functions for changes in the core and keep them updated to match any new features or bug fixes.\r\n\r\nOr I could suggest changes to the core to handle this. This seems like the best route to me, but I don't want to work on such changes if it's unlikely that a pull request would be accepted. Is this something that would be considered a useful enhancement but nobody has put in the leg work yet, or would there be reluctance to change security features?"},"comment":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/comments/164620416","html_url":"https://github.com/cakephp/cakephp/issues/7848#issuecomment-164620416","issue_url":"https://api.github.com/repos/cakephp/cakephp/issues/7848","id":164620416,"user":{"login":"Zuluru","id":514172,"avatar_url":"https://avatars.githubusercontent.com/u/514172?v=3","gravatar_id":"","url":"https://api.github.com/users/Zuluru","html_url":"https://github.com/Zuluru","followers_url":"https://api.github.com/users/Zuluru/followers","following_url":"https://api.github.com/users/Zuluru/following{/other_user}","gists_url":"https://api.github.com/users/Zuluru/gists{/gist_id}","starred_url":"https://api.github.com/users/Zuluru/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zuluru/subscriptions","organizations_url":"https://api.github.com/users/Zuluru/orgs","repos_url":"https://api.github.com/users/Zuluru/repos","events_url":"https://api.github.com/users/Zuluru/events{/privacy}","received_events_url":"https://api.github.com/users/Zuluru/received_events","type":"User","site_admin":false},"created_at":"2015-12-15T02:08:49Z","updated_at":"2015-12-15T02:08:49Z","body":"Not sure whether you mean how the resulting HTML would differ, or how the PHP calls to generate it would change.\r\n\r\nFor the former, either there would need to be a hash added for each optional field (which can start to get long quickly if there are many such fields), or else we serialize and then encrypt (instead of hash) the optional fields (in which case we are exposing ciphertext which has largely known plaintext, which can aid in cracking the key).\r\n\r\nFor the latter, I was thinking that either an optional parameter could be added to `unlockField` to control this, or else a new analogous `optionalField` function could be added."}}