2

Where is the best place in Joomla MVC (server-side) to forbid users from changing a value in a pre-existing form record? In JTable check / bind/ JModel prepareTable, or elsewhere?

For context, I have a form in my component with certain fields that shouldn't change after initial creation - though other fields are editable.

I can disable or simply not render the fields in the edit view of the item if it has an ID, but that won't stop a well-crafted POST, so I'd like to simply 'ignore' a series of values if the data array has an ID > 0 (and thus exists).

2

JTable method check is design for

Method to perform sanity checks on the JTable instance properties to ensure they are safe to store in the database.

JTable method bind is design for

Method to bind an associative array or object to the JTable instance.

So both of them are not designed for what you are trying to do.

However JModel method prepareTable is designed for

Prepare and sanitise the table data prior to saving.

So it's exactly what you need.

protected function prepareTable($table)
{
  // Row exists?
  if ((int)$table->id > 0) {
    // Ignore certain fields
    unset($table->ignoreFieldName);
  }
}
  • Thanks for taking the time to answer - I had a feeling it was prepareTable', but had a look at bind` and saw we have that ignore parameter which won't bind certain values before save. Wondering if that's 'cleaner', as I'm already overriding bind for something else. – codinghands Aug 10 '16 at 13:03
  • 1
    Yes, it is actually an option. And since your are already overriding bind, you can use that. You can pass array of fieldnames or string with space separated field names to ignore. It would work same way and would be cleaner in your situation. – Rene Korss Aug 10 '16 at 13:06
  • Thanks for the input - will leave this open for a day or 2 to see if anyone else has any thoughts, then mark as answered :) – codinghands Aug 10 '16 at 13:10
  • Just working this up now - I've since found prepareTable works better here - bind is called on load AND save, which means any ignored fields won't appear in the edit layout (even as readonly) because they're never bound. Unset in prepareTable works great though! – codinghands Aug 11 '16 at 17:06
  • Yeah. You are absolutely right. Then only prepareTable will be valid solution. – Rene Korss Aug 11 '16 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.