[#23973] - customfields acl problem when field displayed but disabled
- Closed
- 7 Mar 2019
- Medium
- Build: staging
- # 23973
When a custom field is displayed (access level) but not allowed in permission "edit custom field value", the field is displayed but disabled in the edit form (for exemple in com_content).
But when you validate the form, this line return true :
In /librairies/src/Form/Form.php line 2076
$fieldExistsInRequestData = $input->exists((string) $element['name']) || $input->exists($group . '.' . (string) $element['name']);
So it's impossible to validate the form !
// If the field is disabled but it is passed in the request this is invalid as disabled fields are not added to the request
if ($disabled && $fieldExistsInRequestData)
{
// this error is returned...........
return new \RuntimeException(\JText::sprintf('JLIB_FORM_VALIDATE_FIELD_INVALID', $element['name']));
}
Steps to reproduce the issue
Always but not when we don't display the field in the form (option Display When Read-Only set to no in the custom filed options) of course.
Expected result
Actual result
System information (as much as possible)
Additional comments
joomla-cms-bot
- | Labels |
Added:
?
|
||
| Status | New | ⇒ | Information Required |
@rolandalsace which version do you use?
@rolandalsace which version do you use?
J3.9.3
Same problem here. It has been already reported I think and its a huge issue.
Well as linked above there are PR's fixing that issue so it it up to @HLeithner and @laoneo to decide which to merge.
This one by @ggppdk #22942 or this one by me #22923
Both should fix the issue but @laoneo blocked my PR by saying:
This change is not fixing the cause. I think there is something wrong in the Controller or Form class itself.
I personally feel that @ggppdk 's solution is better here but up to @HLeithner and @laoneo to decide. I could be wrong.
I Did not say that your fix is wrong, all I was saying that the check should be done either in the controller or the form class. Because unfortunately this problem does exist also outside of the context of custom fields. When a field is marked as disabled there is not point in validating it.
And this should be done from my point of view the FormController class here https://github.com/joomla/joomla-cms/blob/staging/libraries/src/MVC/Controller/FormController.php#L713. But I guess then we get again into the same issue as was fixed by #19884, that the fields do not land in the save call and empty values can't be erased.
Because I'm not sure if the Form class must be aware about the state of the fields to validate. If this is the case, then for example here https://github.com/joomla/joomla-cms/blob/staging/libraries/src/Form/Form.php#L1226 the field must not being validated. And I guess that this is the place we have to consider. Not sure if we then introduce a BC break then.
For me both pr's are only workarounds and do not fix the root issue. But if @HLeithner want's to go forward with one of them, then I would suggest to use the one from @zero-24, because not every save request comes from a HTML page.
| Status | Information Required | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-03-07 17:24:39 |
| Closed_By | ⇒ | HLeithner |
@infograf768 can you please comment?