Validation on an attribute automagically adds it to 'safe' list

Hello Yii Users!

I’m trying to verify the following behavior in yii-1.1.10.r3566:

When a validation is performed, the validated parameter is automatically added to ‘safe’ parameters and imported from the POST data (even though the scenario doesn’t list it as ‘safe’).

My scenario doesn’t include the ‘pass’ form field:

array('email, usr_name, pass_repeat', 'safe', 'on'=>'noPass'), //only this scenario

and yet I get an error from empty password in the form, when sending empty value:

array('email, usr_name, pass', 'required'), //ALL scenarios

I was expecting what would be validated is $model->pass, and yet it’s from $model->attributes = $_POST;

Of course I have set a scenario before importing the POST data:

$model->scenario='noPass'; //(usuwamy 'pass' z listy 'safe attributes');


        $model->attributes = $_POST['User'];

Is it a bug, or I am doing something wrong ?

Should I list ‘safe’ rules before listing validators in the rules() array (maybe it’s the order of array elements) ?

Thank you for any comments !


I guess this time it’s my fault:

In the controller I’ve manually assigned these values to attributes for some users (bypassing the $model->attributes method)…

NOTE: moved to proper section (General Discussion for Yii 1.1.x instead of Bug Discussions)