Merge branch 'issue-3573' into 3.0

src/View/Helper/FormHelper.php

@@ -1966,9 +1966,24 @@ class FormHelper extends Helper {
 			'timeFormat' => 24,
 			'second' => false,
 		];
+		$secure = true;
+		if (!empty($options['disabled'])) {
+			$secure = false;
+		}
+		if (isset($options['secure'])) {
+			$secure = $options['secure'];
+		}
+		$options['secure'] = static::SECURE_SKIP;
+
 		$options = $this->_initInputField($fieldName, $options);
 		$options = $this->_datetimeOptions($options);
 
+		foreach ($this->_datetimeParts as $type) {
+			if ($options[$type] !== false) {
+				$this->_secure($secure, $fieldName . '.' . $type);
+			}
+		}
+
 		return $this->widget('datetime', $options);
 	}
 
@@ -2091,9 +2106,25 @@ class FormHelper extends Helper {
 		];
 		$options['hour'] = $options['minute'] = false;
 		$options['meridian'] = $options['second'] = false;
+
+		$secure = true;
+		if (!empty($options['disabled'])) {
+			$secure = false;
+		}
+		if (isset($options['secure'])) {
+			$secure = $options['secure'];
+		}
+		$options['secure'] = static::SECURE_SKIP;
+
 		$options = $this->_initInputField($fieldName, $options);
 		$options = $this->_datetimeOptions($options);
 
+		foreach ($this->_datetimeParts as $type) {
+			if ($options[$type] !== false) {
+				$this->_secure($secure, $fieldName . '.' . $type);
+			}
+		}
+
 		return $this->widget('datetime', $options);
 	}
 

tests/TestCase/View/Helper/FormHelperTest.php

@@ -4271,6 +4271,51 @@ class FormHelperTest extends TestCase {
 	}
 
 /**
+ * Test that datetime fields are added to protected fields list.
+ *
+ * @return void
+ */
+	public function testDateTimeSecured() {
+		$this->Form->request->params['_Token'] = ['unlockedFields' => []];
+		$this->Form->dateTime('Contact.date');
+		$expected = [
+			'Contact.date.year',
+			'Contact.date.month',
+			'Contact.date.day',
+			'Contact.date.hour',
+			'Contact.date.minute',
+			'Contact.date.meridian',
+		];
+		$this->assertEquals($expected, $this->Form->fields);
+
+		$this->Form->fields = [];
+		$this->Form->date('Contact.published');
+		$expected = [
+			'Contact.published.year',
+			'Contact.published.month',
+			'Contact.published.day',
+		];
+		$this->assertEquals($expected, $this->Form->fields);
+	}
+
+/**
+ * Test that datetime fields are added to protected fields list.
+ *
+ * @return void
+ */
+	public function testDateTimeSecuredDisabled() {
+		$this->Form->request->params['_Token'] = ['unlockedFields' => []];
+		$this->Form->dateTime('Contact.date', ['secure' => false]);
+		$expected = [];
+		$this->assertEquals($expected, $this->Form->fields);
+
+		$this->Form->fields = [];
+		$this->Form->date('Contact.published', ['secure' => false]);
+		$expected = [];
+		$this->assertEquals($expected, $this->Form->fields);
+	}
+
+/**
  * Test empty defaulting to true for datetime.
  *
  * @return void