cakephp/cakephp — pull request #424 by stefanozoffoli (2012-01-19 16:49:03+00:00)
Title: Patch 2

You can reproduce the problem in Croogo CMS 1.4
In Nodes admin_add view ( https://github.com/croogo/croogo/blob/1.4/View/Nodes/admin_add.ctp )
it adds > 1 TaxonomyData inputs like this:

```php
$taxonomyTree) {
echo $this->Form->input('TaxonomyData.'.$vocabularyId, array(
'label' => $vocabularies[$vocabularyId]['title'],
'type' => 'select',
'multiple' => true,
'options' => $taxonomyTree,
));
}
?>
```

If I select one option of these input, when post data is submitted it gave me security error.
In _validatePost() method of the security component, these fields are flatted that way:

```
Array
(
...
[TaxonomyData.1.0] => 2
[TaxonomyData.2.0] => 3
...
)
```

That, after $multi preg_replace and array_unique, became:

```
Array
(
...
[16] => TaxonomyData.1
[17] => TaxonomyData.2
)
```

So, the check token is calculated with these two item instead of simply:

```
Array
(
...
[16] => TaxonomyData
)
```

like it did on form creating, causing false _validatePost() return and blackhole auth error.