title: Disabling input elements in a CakePHP form that uses Security component and jQuery
body: <p>I have a form in CakePHP that has two live-search text input. Each one of them updates the value of a hidden field when the user selects a result. The model is called <code>Record</code>, and the attributes involved are</p>
  
  <ul>
  <li><code>budget_id</code></li>
  <li><code>program_id</code></li>
  <li><code>concept_id</code></li>
  </ul>
  
  <p>I have created a form <strong>using the FormHelper</strong> in this way:</p>
  
  <pre><code>...
  &lt;?php echo $this-&gt;Form-&gt;create('Record') ?&gt;
  &lt;h1&gt;Create a record&lt;/h1&gt;
  
  &lt;?php echo $this-&gt;Form-&gt;hidden('Record.budget_id', array('value' =&gt; $budget['Budget']['id'])) ?&gt;
  
  &lt;?php echo $this-&gt;Form-&gt;hidden('Record.program_id') ?&gt;
  &lt;?php echo $this-&gt;Form-&gt;input('Record.program_id_search', array(...)) ?&gt;
  
  &lt;?php echo $this-&gt;Form-&gt;hidden('Record.concept_id') ?&gt;
  &lt;?php echo $this-&gt;Form-&gt;input('Record.concept_id_search', array(...)) ?&gt;
  
  &lt;?php echo $this-&gt;Form-&gt;submit('Send') ?&gt;
  &lt;?php echo $this-&gt;Form-&gt;end(); ?&gt;
  ...
  </code></pre>
  
  <p>As you can see, the input fields that store the model attributes are hidden. The live-search boxes are configured with the jQuery's autocomplete plugin.</p>
  
  <p>Following the CakePHP manual recommendations I have disabled the two extra fields in <code>beforeFilter</code> method, so that the Security component ignores them and the form passes validation:</p>
  
  <pre><code>public function beforeFilter() {
    $this-&gt;Security-&gt;disabledFields = array(
      'Record.program_id_search',
      'Record.concept_id_search',
    );
  }
  </code></pre>
  
  <p>It seems that CakePHP gets angry whenever I change the value of hidden inputs from Javascript and it sends me to the <em>blackhole</em> method. That's OK according to documentation.</p>
  
  <p>But what surprises me is that the Security component keeps ignoring my <code>disabledFields</code> settings.</p>
  
  <p>I've been searching in several web sources and everybody point to the <code>disabledFields</code> options. But it does not work for me.</p>
  
  <p>Any suggestions?</p>
  
  <p>Thanks!!</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I have found a workaround but it's really really ugly. I have replaced the hidden input fields with regular select fields, but setting the CSS display property as <code>none</code>.</p>
  
  <p>This way the Security component does not complain anymore, and the user keeps viewing a couple of live-search boxes.</p>
  
  <p>I don't understand why changing a select with Javascript it's ok, but changing a hidden input not.</p>