Input filter specification not merged for Collection

[rogermui]

For attached fieldsets in forms, default input filters are merged with getInputFilterSpecification when $preferFormInputFilter is false. (Form.php#L786-L789)

This does not happen for attached collections.

• The target element's getInputFilterSpecification is added to the CollectionInputFilter's InputFilter as expected.
• When defaults are added, no merging happens as the existing filter isn't seen as the CollectionInputFilter is searched instead of the CollectionInputFilter::inputFilter. (L786)
• Then, when it is searched, the default filter is added directly to the CollectionInputFilter. (L797)

[weierophinney]

Can you please provide::

• a code snippet and/or configuration reproducing the issue
• detail the expected outcome, in terms of code behavior
• detail the actual code behavior observed

This will help us create tests, which will help us diagnose the root cause. Thanks!

[rogermui]

$form = new \Zend\Form\Form;
$form->add(array(
    'name' => 'collection',
    'type' => 'collection',
    'options' => array(
        'target_element' => array(
            'type' => 'Zend\Form\InputFilterProviderFieldset',
            'elements' => array(
                array('spec' => array(
                    'name' => 'date',
                    'type' => 'date'
                ))
            ),
            'options' => array('input_filter_spec' => array(
                'date' => array(
                    'required' => false,
                    'validators' => array(
                        array('name' => 'StringLength')
                    )
                )
            ))
        )
    )
));
$inputFilter = $form->getInputFilter();
$filter = $inputFilter->get('collection')->getInputFilter()->get('date');
$this->assertCount(3, $filter->getValidatorChain()->getValidators());

[rogermui]

To clarify, the (incorrect) input filter that is created from the above test looks like this:

{ // InputFilter
    "collection": { // CollectionInputFilter
        "inputFilter": { // InputFilter
            "date": { // Input
                "validators": ["StringLength"]
                // ...
            }
        },
        "date": { // Input
            "validators": ["Date", "Step"]
            // ...
        }
    }
}

[coder-pm]

Today we came across this problem. It is pretty serious, as "in_array" validator is not working in such a collections, what leads to serious security issues.

[weierophinney]

I need a clarification: what should the input filter look like in this case? I'm assuming that the validators under the collection.date entry should also be under the collection.input_filters.date validators array? and should they be under collection.date at all?

(I need this information in order to write a comprehensive test; only way I can know if the fix is correct is if I know the full set of expectations.)

[coder-pm]

This is highly related to "preferFormInputFilter" property of form. When it is set to false, input validators (defined in in element Zend\Form\Element by Zend\InputFilter\InputProviderInterface) should be merged with fieldset input filter (defined in Zend\Form\Fieldset by Zend\InputFilter\InputFilterProviderInterface), not replaced.

Answering to your question, collection.inputFilter.date should contains "validators": ["StringLength", "Date", "Step"].

It is working like that if element is not a collection.

[weierophinney]

@coder-pm — regarding this statement:

This is highly related to "preferFormInputFilter" property of form.

It's not, at least not for the reported case. Using the example posted by @rogermui above, disabling the preferFormInputFilter property (it's enabled by default) does not change how the composed input filter is created, because we're dealing with a nested collection.

If you can provide a sample where that does make a difference, please open a new issue and/or pull request with a test demonstrating the issue.

I've verified the originally reported issue at this point and have found the root cause, but am still trying to find a solution that works.

[coder-pm]

@weierophinney

It's not, at least not for the reported case. Using the example posted by @rogermui above, disabling the preferFormInputFilter property (it's enabled by default) does not change how the composed input filter is created, because we're dealing with a nested collection.

So right now there is no way to control nested collection input filter, it is always working like form with preferFormInputFilter explicitly set to false. Look at the sample below:

$factory = new \Zend\Form\Factory;
$form = $factory->createForm([
    'fieldsets' => [
        [
            'spec' => [
                'name' => 'baseFieldset',
                'type' => 'Zend\Form\InputFilterProviderFieldset',
                'elements' => [
                    [
                        'spec' => [
                            'name' => 'select',
                            'type' => 'select',
                            'options' => [
                                'value_options' => [
                                    1 => 'foo',
                                    2 => 'bar'
                                ]
                            ]
                        ],
                    ],
                    [
                        'spec' => [
                            'name' => 'collection',
                            'type' => 'collection',
                            'options' => [
                                'target_element' => [
                                    'type' => 'Zend\Form\InputFilterProviderFieldset',
                                    'elements' => [
                                        [
                                            'spec' => [
                                                'name' => 'select',
                                                'type' => 'select',
                                                'options' => [
                                                    'value_options' => [
                                                        1 => 'foo',
                                                        2 => 'bar'
                                                    ]
                                                ]
                                            ]
                                        ]
                                    ],
                                    'options' => [
                                        'input_filter_spec' => [
                                            'select' => [
                                                'required' => false
                                            ]
                                        ]
                                    ]
                                ]
                            ]
                        ]
                    ]
                ],
                'options' => [
                    'use_as_base_fieldset' => true,
                    'input_filter_spec' => [
                        'select' => [
                            'required' => false
                        ]
                    ]
                ]
            ]
        ]
    ],
    'options' => [
        'prefer_form_input_filter' => false
    ]
]);
$inputFilter = $form->getInputFilter();
$fieldsetElementInputFilter = $inputFilter->get('baseFieldset')->get('select');
$collectionElementInputFilter = $inputFilter->get('baseFieldset')->get('collection')->getInputFilter()->get('select');
$this->assertCount(1, $fieldsetElementInputFilter->getValidatorChain()->getValidators()); // this is valid only if 'prefer_form_input_filter' is set to false, otherwise validators are removed
$this->assertCount(1, $collectionElementInputFilter->getValidatorChain()->getValidators()); // this is always working after #ca3ab7