StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>As per the comments, the problem appears because you are changing the hidden values of the form. The way SecurityComponent works, is that it "locks" the name of the fields, so an evildoer can't add new fields or change the values once the form is sent. <em>But</em> it is even more strict with the hidden values, because it locks the field name <strong>and</strong> value. So by changing it with jQuery you're blackhole-ing your own form. </p> <p>There's a nice little post where I learned this, take a <a href="https://web.archive.org/web/20131207065503/http://planetcakephp.org/aggregator/items/4725-understanding-and-escaping-the-dreaded-security-component-blackhole" rel="nofollow">look at it</a>. The author there also explains two ways of bypassing this problem. One is to disable the security for hidden fields, so the hash calculated for the token doesn't include those values... which isn't really secure...<br> And another solution is to modify the FormHelper, and tell it to "lock" the hidden fields <em>names</em> but not the values. I don't remember what version of Cake the author uses for the example, but the code given there should be practicaly the same. So with that solution, you can tell the form to not be so strict with you with an option array.</p> <p>Oh, and the other option given there (this is what I normally use) (I just read it now there... I thought I figure that on my own... oh well), is to just use normal input text fields for the ones you want hidden, and add a css style like <code>display:none</code>. </p> <p>It's up to you what you think is best. I like the css option because is simpler, and really, if someone is going to mess with my css evily (with firebug or something like that), they might just as well do it with the values of hidden fields, it doesn't require any more effort. You should take all the extra steps and verifications when handling that form submission anyway. But like I said, up to you which do you think is best for your situation.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload