UI\Form: adapted to the SubmissionSource model of nette/forms 4.0

The form no longer overrides receiveHttpData(), isAnchored() and
beforeRender(); instead it overrides createDefaultSource() to return
null and sets the @internal FormSubmissionSource when anchored to
a presenter. The source detects submission via the 'submit' signal,
reads the application request and installs the hidden signal field in
its prepare() render hook; it resolves the presenter from the form
lazily, so a form re-anchored to another presenter keeps working. The
catch-up pass of setSubmissionSource() replaces the manual
loadHttpData() loop in validateParent().

The form owns its cross-origin state (private ?FetchSite $allowedOrigin
+ allowCrossOrigin()) independently of nette/forms; the same-origin
check intentionally stays in signalReceived(), where a failure is
reported via Presenter::detectedCsrf().

Requires nette/forms 4.0.

Author: dg

composer.json

@@ -29,7 +29,7 @@
 		"nette/tester": "^2.6",
 		"nette/caching": "^3.2",
 		"nette/di": "^3.2",
-		"nette/forms": "^3.2 || ^4.0",
+		"nette/forms": "^4.0",
 		"nette/robot-loader": "^4.0",
 		"nette/security": "^3.2",
 		"latte/latte": "^3.1.4",
@@ -43,7 +43,7 @@
 	"conflict": {
 		"nette/caching": "<3.2",
 		"nette/di": "<3.2",
-		"nette/forms": "<3.2",
+		"nette/forms": "<4.0",
 		"nette/schema": "<1.3",
 		"latte/latte": "<3.1.4 || >=3.2",
 		"tracy/tracy": "<2.12"

phpstan.neon

@@ -95,11 +95,6 @@ parameters:
 			count: 1
 			path: src/Application/UI/Presenter.php
 
-		# Nette Forms compatibility - methods differ between versions
-		-
-			identifier: method.notFound
-			path: src/Application/UI/Form.php
-
 		# Control::$template->flashes is set dynamically for flash messages
 		-
 			identifier: property.notFound

src/Application/UI/Form.php

@@ -17,8 +17,6 @@ class Form extends Nette\Forms\Form implements SignalReceiver
 {
 	/** @var array<callable(static): void>  Occurs when form is attached to presenter */
 	public array $onAnchor = [];
-
-	/** which Sec-Fetch-Site values are accepted for submission; null disables the check */
 	private ?Nette\Http\FetchSite $allowedOrigin = Nette\Http\FetchSite::SameOrigin;
 
 
@@ -30,9 +28,7 @@ public function __construct(?Nette\ComponentModel\IContainer $parent = null, ?st
 
 
 	/**
-	 * Forward compatibility with nette/forms 4.0: no default submission source materializes,
-	 * the form is anchored via the presenter and detects submission in receiveHttpData().
-	 * Under nette/forms 3.x the method is unused.
+	 * The form is anchored via a presenter; the source is set when the form is attached to it.
 	 */
 	protected function createDefaultSource(): ?Nette\Forms\SubmissionSource
 	{
@@ -53,13 +49,8 @@ protected function validateParent(Nette\ComponentModel\IContainer $parent): void
 				$this->setAction(new Link($presenter, 'this'));
 			}
 
-			$controls = $this->getControls();
-			if (iterator_count($controls) && $this->isSubmitted()) {
-				foreach ($controls as $control) {
-					if (!$control->isDisabled()) {
-						$control->loadHttpData();
-					}
-				}
+			if (!$this->isAnchored()) { // the write-once source survives re-anchoring, it resolves the current presenter itself
+				$this->setSubmissionSource(new FormSubmissionSource); // lets already attached controls load their values
 			}
 
 			Nette\Utils\Arrays::invoke($this->onAnchor, $this);
@@ -94,15 +85,6 @@ public function hasPresenter(): bool
 	}
 
 
-	/**
-	 * Tells if the form is anchored.
-	 */
-	public function isAnchored(): bool
-	{
-		return (bool) $this->getPresenter(throw: false);
-	}
-
-
 	/**
 	 * Disables the same-origin (Sec-Fetch) CSRF check, allowing cross-origin form submissions.
 	 */
@@ -119,38 +101,6 @@ public function disableSameSiteProtection(): void
 	}
 
 
-	/**
-	 * Internal: returns submitted HTTP data or null when form was not submitted.
-	 */
-	protected function receiveHttpData(): ?array
-	{
-		$presenter = $this->getPresenter();
-		if (!$presenter->isSignalReceiver($this, 'submit')) {
-			return null;
-		}
-
-		$request = $presenter->getRequest();
-		if ($request->isMethod('forward') || $request->isMethod('post') !== $this->isMethod('post')) {
-			return null;
-		}
-
-		return $this->isMethod('post')
-			? Nette\Utils\Arrays::mergeTree($request->getPost(), $request->getFiles())
-			: $request->getParameters();
-	}
-
-
-	protected function beforeRender(): void
-	{
-		parent::beforeRender();
-		$key = ($this->isMethod('post') ? '_' : '') . Presenter::SignalKey;
-		if (!isset($this[$key]) && $this->getAction() !== '') {
-			$do = $this->lookupPath(Presenter::class) . self::NameSeparator . 'submit';
-			$this[$key] = (new Nette\Forms\Controls\HiddenField($do))->setOmitted();
-		}
-	}
-
-
 	/********************* interface SignalReceiver ****************d*g**/
 
 

src/Application/UI/FormSubmissionSource.php

@@ -0,0 +1,51 @@
+<?php declare(strict_types=1);
+
+/**
+ * This file is part of the Nette Framework (https://nette.org)
+ * Copyright (c) 2004 David Grudl (https://davidgrudl.com)
+ */
+
+namespace Nette\Application\UI;
+
+use Nette;
+
+
+/**
+ * Source of submitted data for forms anchored to a presenter: detects submission via the 'submit' signal
+ * and reads the application request of the presenter the form is currently attached to. The same-origin
+ * CSRF check intentionally stays in Form::signalReceived(), where a failure is reported to the presenter.
+ * Experimental.
+ * @internal
+ */
+final class FormSubmissionSource implements Nette\Forms\SubmissionSource
+{
+	public function receiveData(Nette\Forms\Form $form): ?array
+	{
+		$presenter = $form->lookup(Presenter::class);
+		if (!$presenter->isSignalReceiver($form, 'submit')) {
+			return null;
+		}
+
+		$request = $presenter->getRequest();
+		if ($request->isMethod('forward') || $request->isMethod('post') !== $form->isMethod('post')) {
+			return null;
+		}
+
+		return $form->isMethod('post')
+			? Nette\Utils\Arrays::mergeTree($request->getPost(), $request->getFiles())
+			: $request->getParameters();
+	}
+
+
+	/**
+	 * Installs the hidden field carrying the 'submit' signal.
+	 */
+	public function prepare(Nette\Forms\Form $form): void
+	{
+		$key = ($form->isMethod('post') ? '_' : '') . Presenter::SignalKey;
+		if (!isset($form[$key]) && $form->getAction() !== '') {
+			$do = $form->lookupPath(Presenter::class) . Nette\ComponentModel\IComponent::NameSeparator . 'submit';
+			$form[$key] = (new Nette\Forms\Controls\HiddenField($do))->setOmitted();
+		}
+	}
+}