html: Form::hidden() should not use old() to set value

Hi,

when adding a checkbox it is nice to add a hidden field with the same name to send a default value to the controller, if the checkbox is not checked.

If the checkbox was checked o form submit and the user is redirected back to the form and the old input is applied to the form, the hidden field value gets overwritten with the checkbox value.

Example: {{ Form::hidden('cb_name', '0') }} {{ Form::checkbox('cb_name', '1') }}

After the redirect with previously checked checkbox “cb_name” the value of the hidden field changes to the value of the checkbox. That means, that if the user unchecks the checkbox, the checkbox value is still sent to the controller with the next submit.

I thin the reason is in FormBuilder::getValueAttribute() method. It uses $this->old() to set the previous value, but in case of hidden fields I think this behaviour is unwanted.

Best Wishes David

About this issue

Original URL
State: closed
Created 7 years ago
Reactions: 1
Comments: 16 (1 by maintainers)

Most upvoted comments

Sometimes the old() flashed data is overwriting the hidden _method field in our generated forms with old data (DELETE to POST, etc.).

Also some hardcoded hidden fields are being changed by other fields of the same name. For example a hidden field paired with a checkbox to provide a false value now gets changed with the checkbox’s value.

This broke for us sometime between 5.4.1 and 5.4.8, and the old behavior allowed us to flash the old session for relevant behavior without any hardcoded values being changed.

We tried fixing most cases by adding the html instead of the Form::hidden helper but it kept popping up so we’ve had to role back to 5.4.1.

ataboo on Jun 20, 2017

In fact, no Form::input() should override what is provided as the $value, which it does as of the 5.4 release. If I pass in a value of foobarbaz, why is it overridden by first old() and then request()->input()?

MarnuLombard on May 31, 2017

Ah I see what’s happening. These lines are now in the getValueAttribute: https://github.com/LaravelCollective/html/blob/v5.4.9/src/FormBuilder.php#L1161-L1164

This uses parameters from the current request, over the value supplied (which is generally preferable, because it allows pre-filling forms based on the request parameters without having to override the defaults if there are matching parameters in the request).

In this case, it would be best to use a plain HTML hidden input, as you don’t need any of the benefits from the library (such as remembering previous values). Your input would simply be:

<input type="hidden" name="step" value="{{ $step }}"/>

As for the other hidden fields, I’m unsure what you’re using them for so can’t comment specifically. Generally if I don’t need anything from the Form builder (such as value changes based on old input, current request etc.) then I would use plain HTML instead.

drn5910 on Feb 13, 2018

Yes, we are submitting directly here. We load a different partial on each step, wich is okay.

You may surely be right in that it might not be a problem related to old(). With 5.4.1, the getValueAttribute() function was returning from

        if (! is_null($value)) {
            return $value;
        }

I confirm that it’s working passing the value withInput() like this: return view('form.edit_step_by_step', $params)->withStep($next_step);

But will I have to do this with all my custom hidden fields? Could you tell me how I will know which value I’ll have to pass “withInput”?

Many thanks.

smilearric on Feb 13, 2018