FormHelper appends ID to explicitly defined URL

[PhantomWatson]

This is a: bug
CakePHP Version: Tested with 3.5.8, but the relevant code appears identical in the latest version (3.6.0-beta1)

What I did

On /users/my-account...

$this->Form->create(
    $user, 
    ['url' => ['controller' => 'Users', 'action' => 'myAccount']]
)

What happened

<form method="post" accept-charset="utf-8" action="/users/my-account/123"> <- ID appended

What I expected to happen

<form method="post" accept-charset="utf-8" action="/users/my-account">

Cause

FormHelper::_formUrl() modifies the value of $options['url'] by appending the current record's ID if $options['url']['_name'] is unspecified and no other numerically-indexed parameters are passed.

In an application I'm reviewing, this has the effect of the form on /users/my-account submitting to /users/my-account/$userId, despite explicitly setting the URL without an ID in $this->Form->create().

Recommendation

• If it wouldn't be considered a breaking change, it would seem appropriate to remove the && isset($options['url']['_name'] from the condition before return $options['url'];, as requiring a route name seems kind of arbitrary.
• Otherwise, a note in the FormHelper documentation about what specific circumstances result in IDs being appended to the URL that the form submits to would be helpful, maybe with an additional mention of workarounds, like simply wrapping the URL array in Router::url() so it gets passed as a string.

[ADmad]

This unfortunately is expected behavior and there are tests for it.

But it is indeed wacky hidden automagic which should be changed in 3.6.

[markstory]

But it is indeed wacky hidden automagic which should be changed in 3.6.

How do we go about removing the current behavior without breaking existing applications? Removing the id addition seems like the kind off thing that would break userland code.

[ADmad]

Removing the id addition seems like the kind off thing that would break userland code.

Guess so, in 4.0 then.

[PhantomWatson]

In the meantime, noting this behavior in the documentation might prevent some confusion for 3.x users. Perhaps just a "To prevent your entity's ID from being appended to the URL supplied $this->Form->create(), wrap URL arrays in Router::url()" or something.

[ADmad]

@PhantomWatson Sounds good, can you please open a PR on the docs repo for the same?

[dereuromark]

Added to roadmap as part of cleanup task: https://github.com/cakephp/cakephp/wiki/4.0-Roadmap#cleanup-tasks
We can close this then. Thank you for bringing this to our attention.