Where to prevent field value change in custom component form record?

Question

Where is the best place in Joomla MVC (server-side) to forbid users from changing a value in a pre-existing form record? In JTable check / bind/ JModel prepareTable, or elsewhere?

For context, I have a form in my component with certain fields that shouldn't change after initial creation - though other fields are editable.

I can disable or simply not render the fields in the edit view of the item if it has an ID, but that won't stop a well-crafted POST, so I'd like to simply 'ignore' a series of values if the data array has an ID > 0 (and thus exists).

Answer 1

JTable method check is design for

Method to perform sanity checks on the JTable instance properties to ensure they are safe to store in the database.

JTable method bind is design for

Method to bind an associative array or object to the JTable instance.

So both of them are not designed for what you are trying to do.

However JModel method prepareTable is designed for

Prepare and sanitise the table data prior to saving.

So it's exactly what you need.

protected function prepareTable($table)
{
  // Row exists?
  if ((int)$table->id > 0) {
    // Ignore certain fields
    unset($table->ignoreFieldName);
  }
}