Merge branch 'master' into 3.1

src/Controller/Component/AuthComponent.php

@@ -424,7 +424,9 @@ class AuthComponent extends Component
             if (!empty($this->_config['loginRedirect'])) {
                 $default = $this->_config['loginRedirect'];
             }
-            $default['_base'] = false;
+            if (is_array($default)) {
+                $default['_base'] = false;
+            }
             $url = $controller->referer($default, true);
         } else {
             $url = $this->_config['unauthorizedRedirect'];

src/ORM/Query.php

@@ -15,6 +15,7 @@
 namespace Cake\ORM;
 
 use ArrayObject;
+use Cake\Database\ExpressionInterface;
 use Cake\Database\Query as DatabaseQuery;
 use Cake\Database\ValueBinder;
 use Cake\Datasource\QueryTrait;
@@ -713,15 +714,28 @@ class Query extends DatabaseQuery implements JsonSerializable
     {
         $query = $this->cleanCopy();
         $counter = $this->_counter;
-
         if ($counter) {
             $query->counter(null);
             return (int)$counter($query);
         }
 
+        $complex = (
+            $query->clause('distinct') ||
+            count($query->clause('group')) ||
+            count($query->clause('union')) ||
+            $query->clause('having')
+        );
+        if (!$complex) {
+            // Expression fields could have bound parameters.
+            foreach ($query->clause('select') as $field) {
+                if ($field instanceof ExpressionInterface) {
+                    $complex = true;
+                    break;
+                }
+            }
+        }
+
         $count = ['count' => $query->func()->count('*')];
-        $complex = count($query->clause('group')) || $query->clause('distinct') || $query->clause('having');
-        $complex = $complex || count($query->clause('union'));
 
         if (!$complex) {
             $query->eagerLoader()->autoFields(false);

src/View/Helper/FormHelper.php

@@ -653,6 +653,8 @@ class FormHelper extends Helper
             if (!in_array($field, $this->fields)) {
                 if ($value !== null) {
                     return $this->fields[$field] = $value;
+                } elseif (isset($this->fields[$field]) && $value === null) {
+                    unset($this->fields[$field]);
                 }
                 $this->fields[] = $field;
             }

tests/TestCase/Controller/Component/AuthComponentTest.php

@@ -782,6 +782,47 @@ class AuthComponentTest extends TestCase
     }
 
     /**
+     * test unauthorized redirect defaults to loginRedirect
+     * which is a string URL.
+     *
+     * @return void
+     */
+    public function testRedirectToUnauthorizedRedirectLoginAction()
+    {
+        $url = '/party/on';
+        $this->Auth->Flash = $this->getMock(
+            'Cake\Controller\Component\FlashComponent',
+            ['set'],
+            [$this->Controller->components()]
+        );
+        $this->Auth->request = $request = new Request([
+            'url' => $url,
+            'session' => $this->Auth->session
+        ]);
+        $this->Auth->request->addParams(Router::parse($url));
+        $this->Auth->config('authorize', ['Controller']);
+        $this->Auth->setUser(['username' => 'admad', 'password' => 'cake']);
+
+        $this->Auth->config('unauthorizedRedirect', true);
+        $this->Auth->config('loginAction', '/users/login');
+
+        $response = new Response();
+        $Controller = $this->getMock(
+            'Cake\Controller\Controller',
+            ['on', 'redirect'],
+            [$request, $response]
+        );
+
+        // Uses referrer instead of loginAction.
+        $Controller->expects($this->once())
+            ->method('redirect')
+            ->with($this->equalTo('/'));
+
+        $event = new Event('Controller.startup', $Controller);
+        $this->Auth->startup($event);
+    }
+
+    /**
      * testRedirectToUnauthorizedRedirectSuppressedAuthError
      *
      * @return void

tests/TestCase/ORM/QueryTest.php

@@ -1458,6 +1458,57 @@ class QueryTest extends TestCase
         $this->assertSame(3, $result);
     }
 
+    /**
+     * Test getting counts from queries with contain.
+     *
+     * @return void
+     */
+    public function testCountWithSubselect()
+    {
+        $table = TableRegistry::get('Articles');
+        $table->belongsTo('Authors');
+        $table->hasMany('ArticlesTags');
+
+        $counter = $table->ArticlesTags->find();
+        $counter->select([
+                'total' => $counter->func()->count('*')
+            ])
+            ->where([
+                'ArticlesTags.tag_id' => 1,
+                'ArticlesTags.article_id' => new IdentifierExpression('Articles.id')
+            ]);
+
+        $result = $table->find('all')
+            ->select([
+                'Articles.title',
+                'tag_count' => $counter
+            ])
+            ->matching('Authors', function ($q) {
+                return $q->where(['Authors.id' => 1]);
+            })
+            ->count();
+        $this->assertSame(2, $result);
+    }
+
+    /**
+     * Test getting counts with complex fields.
+     *
+     * @return void
+     */
+    public function testCountWithExpressions()
+    {
+        $table = TableRegistry::get('Articles');
+        $query = $table->find();
+        $query->select([
+            'title' => $query->func()->concat(
+                ['title' => 'literal', 'test'],
+                ['string']
+            ),
+        ]);
+        $query->where(['id' => 1]);
+        $this->assertCount(1, $query->all());
+        $this->assertEquals(1, $query->count());
+    }
 
     /**
      * test count with a beforeFind.

tests/TestCase/View/Helper/FormHelperTest.php

@@ -1701,6 +1701,31 @@ class FormHelperTest extends TestCase
     }
 
     /**
+     * Test that a hidden field followed by a visible field
+     * undoes the hidden field locking.
+     *
+     * @return void
+     */
+    public function testSecuredInputDuplicate()
+    {
+        $this->Form->request->params['_Token'] = ['key' => 'testKey'];
+        $this->assertEquals([], $this->Form->fields);
+
+        $this->Form->input('text_val', [
+                'type' => 'hidden',
+                'value' => 'some text',
+        ]);
+        $expected = ['text_val' => 'some text'];
+        $this->assertEquals($expected, $this->Form->fields);
+
+        $this->Form->input('text_val', [
+                'type' => 'text',
+        ]);
+        $expected = ['text_val'];
+        $this->assertEquals($expected, $this->Form->fields);
+    }
+
+    /**
      * Tests that the correct keys are added to the field hash index
      *
      * @return void