Fix datetime fields not being secured.

Ensure all the various datetime fields are added to Form->fields so they
are not blackholed later.

Fixes #3573

src/View/Helper/FormHelper.php

@@ -345,7 +345,6 @@ class FormHelper extends Helper {
 		if (!empty($append)) {
 			$append = $templater->format('hiddenblock', ['content' => $append]);
 		}
-
 		$this->_lastAction = $action;
 		if (strpos($action, '://')) {
 			$query = parse_url($action, PHP_URL_QUERY);
@@ -1955,9 +1954,21 @@ class FormHelper extends Helper {
 			'timeFormat' => 24,
 			'second' => false,
 		];
+		$secure = true;
+		if (isset($options['secure'])) {
+			$secure = $options['secure'];
+		}
+		$options['secure'] = static::SECURE_SKIP;
+
 		$options = $this->_initInputField($fieldName, $options);
 		$options = $this->_datetimeOptions($options);
 
+		foreach ($this->_datetimeParts as $type) {
+			if ($options[$type] !== false) {
+				$this->_secure($secure, $fieldName . '.' . $type);
+			}
+		}
+
 		return $this->widget('datetime', $options);
 	}
 
@@ -2080,9 +2091,22 @@ class FormHelper extends Helper {
 		];
 		$options['hour'] = $options['minute'] = false;
 		$options['meridian'] = $options['second'] = false;
+
+		$secure = true;
+		if (isset($options['secure'])) {
+			$secure = $options['secure'];
+		}
+		$options['secure'] = static::SECURE_SKIP;
+
 		$options = $this->_initInputField($fieldName, $options);
 		$options = $this->_datetimeOptions($options);
 
+		foreach ($this->_datetimeParts as $type) {
+			if ($options[$type] !== false) {
+				$this->_secure($secure, $fieldName . '.' . $type);
+			}
+		}
+
 		return $this->widget('datetime', $options);
 	}
 

tests/TestCase/View/Helper/FormHelperTest.php

@@ -4234,6 +4234,34 @@ class FormHelperTest extends TestCase {
 	}
 
 /**
+ * Test that datetime fields are added to protected fields list.
+ *
+ * @return void
+ */
+	public function testDateTimeSecured() {
+		$this->Form->request->params['_Token'] = ['unlockedFields' => []];
+		$this->Form->dateTime('Contact.date');
+		$expected = [
+			'Contact.date.year',
+			'Contact.date.month',
+			'Contact.date.day',
+			'Contact.date.hour',
+			'Contact.date.minute',
+			'Contact.date.meridian',
+		];
+		$this->assertEquals($expected, $this->Form->fields);
+
+		$this->Form->fields = [];
+		$this->Form->date('Contact.published');
+		$expected = [
+			'Contact.published.year',
+			'Contact.published.month',
+			'Contact.published.day',
+		];
+		$this->assertEquals($expected, $this->Form->fields);
+	}
+
+/**
  * Test empty defaulting to true for datetime.
  *
  * @return void