Understanding when Model's $validate rules work - validation

Question

I'm trying to activate a user with CakePHP 2 by activation url, but I get a validation error used on user registration page.
I've created a registration action and view, where I've defined this UserModel validation rules:
<?php
class User extends AppModel {
public $name = 'User';
public $validate = array (
'username' => array (
'not_empty' => array (
'rule' => 'notEmpty',
'message' => 'Username cannot be empty'
)
),
'password' => array (
'not_empty' => array (
'rule' => 'notEmpty',
'message' => 'Password cannot be empty'
),
'between_chars' => array (
'rule' => array ('between', 5, 40),
'message' => 'Password must be between 5 and 40 chars'
),
'match_password' => array (
'rule' => 'matchPasswords',
'message' => 'Password is different from Password confirm'
)
),
'password_confirm' => array (
'not_empty' => array (
'rule' => 'notEmpty',
'message' => 'Password confirm cannot be empty'
),
'between_chars' => array (
'rule' => array ('between', 5, 40),
'message' => 'Password confirm must be between 5 and 40 chars'
)
),
'email' => array (
'invalid_email' => array (
'rule' => 'email',
'message' => 'Invalid email, try again'
),
'existing_email' => array (
'rule' => 'isUnique',
'message' => 'This email is already registered'
)
),
'activation_key' => array (
'alphanumeric_key' => array(
'allowEmpty' => true,
'rule' => 'alphaNumeric',
'message' => 'Invalid activation key',
'last' => true
)
)
);
public function matchPasswords ($data) {
debug($this->data); // Undefined index: password_confirm [APP/Model/User.php, line 59] points here
if ($data['password'] == $this->data['User']['password_confirm']) {
return true;
}
$this->invalidate('password_confirm', 'Password confirm must be equal to Password field');
return false;
}
public function beforeSave () {
if (isset($this->data['User']['password'])) {
$this->data['User']['password'] = AuthComponent::password($this->data['User']['password']);
}
return true;
}
}
?>
Everything works perfect until I reach the activate action of the UsersController with the activation code, here I get an Undefined index: password_confirm [APP/Model/User.php, line 59] which points to matchPasswords of the User Model validation rule.
<?php
App::uses('CakeEmail', 'Network/Email');
class UsersController extends AppController {
public $name = 'Users';
public function index () {
$this->User->recursive = 0;
$this->set('users', $this->User->find('all'));
}
public function view ($id = null) {
if (!$id) {
$this->Session->setFlash('Invalid user');
$this->redirect(array('action'=>'index'));
}
$this->User->id = $id;
if (!$this->User->exists()) {
throw new NotFoundException('Invalid user');
}
$this->set('user', $this->User->read());
}
public function edit () {
}
public function delete () {
}
public function register () {
// code for user registration
}
public function registration ($sub_action = null) {
}
public function password ($sub_action = null, $code = null) {
if ($sub_action == 'reset' && !empty ($code)) {
$this->render('password_reset_code');
} else if ($sub_action == 'reset' && empty ($code)) {
$this->render('password_reset_mail');
}
}
public function login () {
if ($this->request->is('post')) {
if ($this->Auth->login()) {
$this->redirect ($this->Auth->redirect());
} else {
$this->Session->setFlash('Errore di accesso, email/password sbagliati, ricontrolla i dati inseriti');
}
}
}
public function logout () {
$this->redirect($this->Auth->logout());
}
public function activate ($code = null) {
if (!empty ($code)) {
$user = $this->User->find('first', array('conditions' => array('User.activation_key' => $code)));
if (!empty($user)) {
$user['User']['activation_key'] = null;
$user['User']['active'] = 1;
if ($this->User->save($user)) { // here is where Invalid index error starts
$this->render('activation_successful');
} else {
$this->set('status', 'Salvataggio fallito');
$this->render('activation_fail');
}
// debug($this->User->invalidFields());
// debug($this->User->data);
} else {
$this->set('status', 'Nessun account collegato alla chiave');
$this->render('activation_fail');
}
} else {
$this->set('status', 'Nessuna chiave');
$this->render('activation_fail');
}
}
private function registrationEmail ($account_email, $username, $code) {
// code for email registration
}
}
?>
Why I get the error?
Why matchPasswords is executed in the activate action?
Are these validation rules executed in every view of the controller?

Answer 1

Try setting the User model's id before the save in the activate() function:
$this->User->id = $user['User']['id'];
or something similar.
When you don't set the id prior to the save() function, it tries to make a new table row. That's why it's validating everything.

Answer 2

Try changing
if ($data['password'] == $this->data['User']['password_confirm']) {
to
if (isset($this->data['User']['password_confirm']) && $data['password'] == $this->data['User']['password_confirm']) {
in your matchPasswords function in the User.php
In the activate action you are getting all of the fields for the user and then saving them so within the data you are saving will be the password field. As the password field is there CakePHP is trying to validate it against the password_confirm field which does not exist.
You should only validate that the password and password confirm fields match when they are both present, i.e when you have the password_confirm in your form.