[8.x] Fix fields not required with required_unless

[dshoreman]

In v8.40, given a form with this data:

['foo' => true]

...and this rule in the FormRequest:

['bar' => 'required_unless:baz,true'],

The short-circuit introduced in #37128 prevents 'validateRequired' from being called on bar when baz is omitted from data - even though the very lack of it might mean "bar" should be required.

Removing the short-circuit from required_unless seems to solve the issue without breaking anything else. I tried false first, but that just broke it differently so I added cases to cover that too.

[dshoreman]

@driesvints Mind checking this over please?

From what I can see, the second point in #37128 should be fine for most rules, it's only the unless that has an issue. I think most null/true type cases should be covered with this, but I'd appreciate your input in case I missed something

[driesvints]

In the example you've given the field is not present in the data set. The anotherfield is also not present in the data set. Therefor the validation passes.

If required_unless should be invoked even if baz isn't in the dataset then yes it should fail. But that's not how I understand that things should work.

@taylorotwell we've made the adjustments under the above understanding. If it should be the other way around please let me know and I'll tackle those use cases as well from 6.x and up.

[taylorotwell]

IMO it should likely be required. It's required if baz is not true - which it isn't - it is missing. Therefore, IMO, it should be required.

[driesvints]

I'll try to update the behavior on 6.x as well soon as well as for the exclude_unless rule.

[dshoreman]

In the example you've given the field is not present in the data set. The anotherfield is also not present in the data set. Therefor the validation passes.

To provide the real-world example it was based on, my project was failing with the data ['name' => 'foo']. I have a rule that requires the 'gid' field unless user_group is true. That is, when user_group is provided and true the gid can be calculated automatically, but it must be provided manually otherwise.

The value of anotherfield seems to be of particular importance here. With required_unless:foo,null the early return would produce the expected result (unless we expect for "not set" and "null" to be two different things - I wasn't sure here so I wrote the test assuming unset == null). For non-null values though, the lack of 'anotherfield' usually (but not always) means the opposite.

[driesvints]

@dshoreman okay, I think we finally got to the bottom of the behavior we want. I already sent in #37291 to backport it to 6.x and will send in a PR to the docs as well.

[dshoreman]

Thanks @driesvints, much appreciated.

This was the only thing left broken for me in the most recent version, so I look forward to updating from 8.37 soon! 🚀