paulredmond / chosen-cakephp Goto Github PK

Based on notable changes in https://github.com/harvesthq/chosen/releases/tag/1.0.0 the default CSS class prefix needs updated in the Helper configuration.

This variable is outdated in the new jQuery.

By convention of CakePHP SecurityComponant it is strongly recommended that the from must be created using FormHelper. http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html#security. Here what it says:

When using the Security Component you must use the FormHelper to create your forms. In addition, you must not override any of the fields’ “name” attributes. The Security Component looks for certain indicators that are created and managed by the FormHelper (especially those created in create() and end()). Dynamically altering the fields that are submitted in a POST request (e.g. disabling, deleting or creating new fields via JavaScript) is likely to trigger a black-holing of the request. See the $validatePost or $disabledFields configuration parameters.

Now, if I use ChosenHelper will I face security issues or is there any possibility that the security of the website may hamper? Kindly explain it clearly. :)

Should the Chosen assets be installed through another source? (E.g. Bower, Composer). Would be nice to see the vendor package decoupled from this plug-in. At the very least, if someone didn't want to use a package manager, they could always download the archive of the release and follow instructions to drop the contents in the /webroot directory, or wherever would be best.

Thoughts?

I'm going to experiment with using the FriendsOfCake/travis package on this to get some practice with it. I'll post whatever I find out here.