Merge pull request #145 from neos/bugfix/143-allow-arbitrary-objects-…

…in-formstate

BUGFIX: Allow arbitrary objects in the FormState

Classes/Core/Runtime/FormRuntime.php

@@ -181,7 +181,8 @@ protected function initializeFormStateFromRequest()
             $this->formState = new FormState();
         } else {
             $serializedFormState = $this->hashService->validateAndStripHmac($serializedFormStateWithHmac);
-            $this->formState = unserialize(base64_decode($serializedFormState), ['allowed_classes' => [FormState::class, \DateTime::class, \DateTimeImmutable::class]]);
+            /** @noinspection UnserializeExploitsInspection The unserialize call is safe because of the HMAC check above */
+            $this->formState = unserialize(base64_decode($serializedFormState));
         }
     }
 

Tests/Functional/Fixtures/FormFactories/TwoPageFormWithUploadFactory.php

@@ -0,0 +1,33 @@
+<?php
+namespace Neos\Form\Tests\Functional\Fixtures\FormFactories;
+
+/*
+ * This file is part of the Neos.Form package.
+ *
+ * (c) Contributors of the Neos Project - www.neos.io
+ *
+ * This package is Open Source Software. For the full copyright and license
+ * information, please view the LICENSE file which was distributed with this
+ * source code.
+ */
+
+use Neos\Form\Core\Model\FormDefinition;
+use Neos\Form\Factory\AbstractFormFactory;
+
+class TwoPageFormWithUploadFactory extends AbstractFormFactory
+{
+    public function build(array $configuration, $presetName)
+    {
+        $formDefinition = new FormDefinition('two-page-form-with-upload', $this->getPresetConfiguration($presetName));
+
+        $page1 = $formDefinition->createPage('page1');
+        $page2 = $formDefinition->createPage('page2');
+
+        $fileUpload = $page1->createElement('file', 'Neos.Form:FileUpload');
+        $fileUpload->setProperty('allowedExtensions', ['txt']);
+        $page1->createElement('date', 'Neos.Form:DatePicker');
+        $page2->createElement('text2-1', 'Neos.Form:SingleLineText');
+
+        return $formDefinition;
+    }
+}

Tests/Functional/Fixtures/dummy.txt

@@ -0,0 +1 @@
+This is just a dummy file

Tests/Functional/SimpleFormTest.php

@@ -21,6 +21,8 @@
  */
 class SimpleFormTest extends AbstractFunctionalTestCase
 {
+    protected static $testablePersistenceEnabled = true;
+
     /**
      * @test
      */
@@ -106,6 +108,27 @@ public function validationIsNotSkippedForGetRequests()
         Assert::assertSame(' error', $this->browser->getCrawler()->filterXPath('//*[contains(@class,"error")]//input[@id="three-page-form-with-validation-text2-1"]')->attr('class'));
     }
 
+    /**
+     * @test
+     * @see https://github.com/neos/form/issues/126
+     * @see https://github.com/neos/form/issues/135
+     * @see https://github.com/neos/form/issues/143
+     */
+    public function formStateCanContainArbitraryObjects()
+    {
+        $this->browser->request('http://localhost/test/form/simpleform/TwoPageFormWithUpload');
+
+        $form = $this->browser->getForm();
+        $form->get('--two-page-form-with-upload[file]')->upload(__DIR__ . '/Fixtures/dummy.txt');
+        $form->get('--two-page-form-with-upload[date][date]')->setValue('1980-12-13');
+        $this->gotoNextFormPage($form);
+        $response = $this->gotoPreviousFormPage($this->browser->getForm());
+        $form = $this->browser->getForm();
+        // Note: we can't use $form['--two-page-form-with-upload']['file']['originallySubmittedResource']['__identity'] because that is overruled by the $form['--two-page-form-with-upload']['file'] element
+        Assert::assertStringContainsString('<input type="hidden" name="--two-page-form-with-upload[file][originallySubmittedResource][__identity]"', $response->getBody()->getContents());
+        Assert::assertSame('1980-12-13', $form->get('--two-page-form-with-upload[date][date]')->getValue());
+    }
+
     /**
      * This is an edge-case which occurs if somebody makes the formState persistent, which can happen when subclassing the FormRuntime.
      *