CakePHP: Securely setting a default value on a form - php

Question

In CakePHP 2.4, how does one securely set part of a form to a default value?
On my user registration view, I'm currently setting the default group_id to 3 with this- but it seems like it would be a huge security hole to do it in the view, should anyone forge a form.
<?php echo $this->Form->hidden('group_id', array('value'=>'3')); ?>
My current register method:
public function register() {
if ($this->request->is('post')) {
$this->User->create();
if ($this->User->save($this->request->data)) {
$this->Session->setFlash(__('The user has been saved'), 'flash/success');
$this->redirect(array('action' => 'index'));
} else {
$this->Session->setFlash(__('The user could not be saved. Please, try again.'), 'flash/error');
}
}
}

Answer 1

Don't set the value in the form but before you save the data. Only set values in hidden fields if it is required to be done in the view layer, if not always set such values in the controller, better model. Remember: Fat models, skinny controllers.
You should always use the Security component in your projects to avoid form tampering and other attacks.
Have a read about the security component here http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html#form-tampering-prevention
By default SecurityComponent prevents users from tampering with forms.
It does this by working with FormHelper and tracking which files are
in a form. It also keeps track of the values of hidden input elements.
All of this data is combined and turned into a hash. When a form is
submitted, SecurityComponent will use the POST data to build the same
structure and compare the hash.
Add this component to your add model.
You can save the value in beforeSave() as well, you just need to check if the record is going to be a new one or if it already exists by checking if the id is present.
public function beforeSave($options = array()) {
if (empty($this->id) && empty($this->data[$this->alias][$this->primaryKey])) {
$this->data[$this->alias]['group_id'] = 3;
}
return true;
}
Usually the id is only present when the record exists, if you want to make it more solid you can check exists() for that id as well to be totally sure it's not already there.
Another best practice hint:
$this->data[$this->alias]['group_id'] = 3;
Sucks. Nobody ever knows what 3 is. If the groups are not changing it is better to have an empty, tableless model or a simple class with constants:
$this->data[$this->alias]['group_id'] = UserGroup::USER;
$this->data[$this->alias]['group_id'] = UserGroup::ADMIN;
$this->data[$this->alias]['group_id'] = // You get the idea...
If the groups are dynamic for some reason I guess they still have some kind of identifier:
$this->data[$this->alias]['group_id'] = $this->UserGroup->getDefaultGroupId();

Answer 2

This should be done in your User model. There is a model's callback called beforeSave you can use it to add the group_id value. Don't do it from the view.
//in User.php
public function beforeSave(){
$this->data['User']['group_id'] = 3;
}
See more in the official documentation.
Edited:
To know the current action we will use the Router object according to the following question's answer: $this->params returns null in cakephp model
So, we may modify the previous code to be:
//in User.php
public function beforeSave(){
$params = Router::getParams();
if ($params['action'] == 'register'){
$this->data['User']['group_id'] = 3;
}
}