From bc4b0913b466f76e916fa690c5a43063de7ac418 Mon Sep 17 00:00:00 2001
From: Christian Flothmann <christian.flothmann@sensiolabs.de>
Date: Mon, 4 Feb 2019 19:26:43 +0100
Subject: [PATCH] ignore _method forms in NativeRequestHandler

---
 .../Component/Form/NativeRequestHandler.php   |  4 ++
 .../Form/Tests/NativeRequestHandlerTest.php   | 53 +++++++++++++++++++
 2 files changed, 57 insertions(+)

diff --git a/src/Symfony/Component/Form/NativeRequestHandler.php b/src/Symfony/Component/Form/NativeRequestHandler.php
index ffe91ba7604d..70f87299d826 100644
--- a/src/Symfony/Component/Form/NativeRequestHandler.php
+++ b/src/Symfony/Component/Form/NativeRequestHandler.php
@@ -115,6 +115,10 @@ public function handleRequest(FormInterface $form, $request = null)
             return;
         }
 
+        if (\is_array($data) && array_key_exists('_method', $data) && $method === $data['_method'] && !$form->has('_method')) {
+            unset($data['_method']);
+        }
+
         $form->submit($data, 'PATCH' !== $method);
     }
 
diff --git a/src/Symfony/Component/Form/Tests/NativeRequestHandlerTest.php b/src/Symfony/Component/Form/Tests/NativeRequestHandlerTest.php
index 077f477d4a23..7eb3632c415c 100644
--- a/src/Symfony/Component/Form/Tests/NativeRequestHandlerTest.php
+++ b/src/Symfony/Component/Form/Tests/NativeRequestHandlerTest.php
@@ -179,6 +179,59 @@ public function testMethodOverrideHeaderIgnoredIfNotPost()
         $this->assertFalse($form->isSubmitted());
     }
 
+    public function testFormIgnoresMethodFieldIfRequestMethodIsMatched()
+    {
+        $form = $this->createForm('foo', 'PUT', true);
+        $form->add($this->createForm('bar'));
+
+        $this->setRequestData('PUT', [
+            'foo' => [
+                '_method' => 'PUT',
+                'bar' => 'baz',
+            ],
+        ]);
+
+        $this->requestHandler->handleRequest($form, $this->request);
+
+        $this->assertSame([], $form->getExtraData());
+    }
+
+    public function testFormDoesNotIgnoreMethodFieldIfRequestMethodIsNotMatched()
+    {
+        $form = $this->createForm('foo', 'PUT', true);
+        $form->add($this->createForm('bar'));
+
+        $this->setRequestData('PUT', [
+            'foo' => [
+                '_method' => 'DELETE',
+                'bar' => 'baz',
+            ],
+        ]);
+
+        $this->requestHandler->handleRequest($form, $this->request);
+
+        $this->assertSame(['_method' => 'DELETE'], $form->getExtraData());
+    }
+
+    public function testMethodSubFormIsSubmitted()
+    {
+        $form = $this->createForm('foo', 'PUT', true);
+        $form->add($this->createForm('_method'));
+        $form->add($this->createForm('bar'));
+
+        $this->setRequestData('PUT', [
+            'foo' => [
+                '_method' => 'PUT',
+                'bar' => 'baz',
+            ],
+        ]);
+
+        $this->requestHandler->handleRequest($form, $this->request);
+
+        $this->assertTrue($form->get('_method')->isSubmitted());
+        $this->assertSame('PUT', $form->get('_method')->getData());
+    }
+
     protected function setRequestData($method, $data, $files = [])
     {
         if ('GET' === $method) {