CakePHP 2.4: Getting large, extensible forms past SecurityComponent? - php

Question

What is the most secure way to submit large, extensible forms with CakePHP (2.4) and SecurityComponent?
I have a form on my app which creates new fields to store new subrecords (and sub-subrecords) using jQuery. This clashes with Cake's SecurityComponent, which expects all fields on a submitted form to have been created server-side by FormHelper.
In the past, when I've been only saving records across one association, I've been able to limit fields user-side to a high but workable number like 100, and explicitly unlock each and every possible field the form could generate:
while($i < 100){
$this->Form->unlockField('ChildModel.' . $i . '.value'); $i++;
// unlock other fields for that possible record
}
However, with this new form I have to save data across not one but two relationships. Users can potentially create a lot of sub-records or sub-sub-records, so the namespace ChildModel.[1-100].field, ChildModel.[1-100].GrandchildModel.[1-100].field starts to get huge. Unlocking a namespace of tens of thousands of possible fields, very few of which are going to be used but all of which are potentially going to be needed, starts to sound really crazy.
What solutions have other CakePHP devs found to get around this issue? I presume this is something that other people have encountered, where disabling Security for the entire action is simply not an option.

Answer 1

Personally I'm doing it this way:
Use AJAX to send the information of the dynamic fields to create back to the server
Genereate a form with the new inputs
Extract the token values from the generated form HTML and pass them back together with the generated HTML of the new fields
Inject the generated HTML and token values into the existing form
???
Profit!
Here's a very basic stripped example from an older project, it is used to add additional inputs for a single association.
Server side:
App::uses('Xml', 'Utility');
$formHtml = $this->Form->create('Model');
$this->Form->input('some_field');
$this->Form->input('also_a_field');
$dynamicInputs = array();
for($i = 0; $i < $numberOfEntries; $i ++)
{
$dynamicInputs[] = $this->Form->input('AssociatedModel.' . $i . '.field');
}
$formHtml .= $this->Form->end();
$xml = Xml::build($formHtml);
$formData = Xml::toArray($xml);
$data = array
(
'token' => array
(
'key' => array
(
'id' => $formData['form']['div'][0]['input'][1]['#id'],
'value' => $formData['form']['div'][0]['input'][1]['#value']
),
'fields' => array
(
'id' => $formData['form']['div'][2]['input'][0]['#id'],
'value' => $formData['form']['div'][2]['input'][0]['#value']
),
'unlocked' => array
(
'id' => $formData['form']['div'][2]['input'][1]['#id'],
'value' => $formData['form']['div'][2]['input'][1]['#value']
)
),
'dynamicInputs' => $dynamicInputs
);
echo json_encode($data);
Frontend (using jQuery):
var form = $('#my-form');
function addEntry()
{
var inputs = form.find('.associated-model .input');
var numberOfEntries = inputs.length + 1;
$.ajax({
url: '/controller/action/whatever',
type: 'POST',
data: 'numberOfEntries=' + numberOfEntries + '&' + form.serialize(),
dataType: 'json',
success: function(data)
{
updateForm(data);
}
});
}
function updateForm(data)
{
var tokenKey = form.find('input[name=\'data[_Token][key]\']');
tokenKey.attr('id', data.token.key.id);
tokenKey.attr('value', data.token.key.value);
var tokenFields = form.find('input[name=\'data[_Token][fields]\']');
tokenFields.attr('id', data.token.fields.id);
tokenFields.attr('value', data.token.fields.value);
var tokenUnlocked = form.find('input[name=\'data[_Token][unlocked]\']');
tokenUnlocked.attr('id', data.token.unlocked.id);
tokenUnlocked.attr('value', data.token.unlocked.value);
form.find('.associated-model').empty().append(data.dynamicInputs.join('\n'));
}