From 04462f5b4c4258ba8afdf13da4d50f0736158b03 Mon Sep 17 00:00:00 2001
From: Sam Georges <sam@daftspunk.com>
Date: Wed, 17 Sep 2014 18:14:47 +1000
Subject: [PATCH] The manage form should not share its session key with the
 parent

---
 modules/backend/behaviors/RelationController.php | 16 ++++++++++++----
 .../relationcontroller/partials/_manage_form.htm |  8 +++++---
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/modules/backend/behaviors/RelationController.php b/modules/backend/behaviors/RelationController.php
index 5d39e3d42..f16d474a3 100644
--- a/modules/backend/behaviors/RelationController.php
+++ b/modules/backend/behaviors/RelationController.php
@@ -359,6 +359,7 @@ class RelationController extends ControllerBehavior
         $this->vars['relationManageWidget'] = $this->manageWidget;
         $this->vars['relationViewWidget'] = $this->viewWidget;
         $this->vars['relationPivotWidget'] = $this->pivotWidget;
+        $this->vars['relationSessionKey'] = $this->relationGetSessionKey();
     }
 
     /**
@@ -437,6 +438,9 @@ class RelationController extends ControllerBehavior
         if ($this->manageMode == 'pivot' && $this->manageId)
             return $this->onRelationManagePivotForm();
 
+        // The form should not share its session key with the parent
+        $this->vars['newSessionKey'] = str_random(40);
+
         $view = 'manage_' . $this->manageMode;
         return $this->relationMakePartial($view);
     }
@@ -449,7 +453,8 @@ class RelationController extends ControllerBehavior
         $this->beforeAjax();
 
         $saveData = $this->manageWidget->getSaveData();
-        $this->relationObject->create($saveData, $this->relationGetSessionKey());
+        $newModel = $this->relationObject->create($saveData, $this->relationGetSessionKey(true));
+        $newModel->commitDeferred($this->manageWidget->getSessionKey());
 
         return ['#'.$this->relationGetId('view') => $this->relationRenderView()];
     }
@@ -462,7 +467,7 @@ class RelationController extends ControllerBehavior
         $this->beforeAjax();
 
         $saveData = $this->manageWidget->getSaveData();
-        $this->relationObject->find($this->manageId)->save($saveData, $this->relationGetSessionKey());
+        $this->relationObject->find($this->manageId)->save($saveData, $this->manageWidget->getSessionKey());
 
         return ['#'.$this->relationGetId('view') => $this->relationRenderView()];
     }
@@ -800,11 +805,14 @@ class RelationController extends ControllerBehavior
     /**
      * Returns the active session key.
      */
-    public function relationGetSessionKey()
+    public function relationGetSessionKey($force = false)
     {
-        if ($this->sessionKey)
+        if ($this->sessionKey && !$force)
             return $this->sessionKey;
 
+        if (post('_relation_session_key'))
+            return $this->sessionKey = post('_relation_session_key');
+
         if (post('_session_key'))
             return $this->sessionKey = post('_session_key');
 
diff --git a/modules/backend/behaviors/relationcontroller/partials/_manage_form.htm b/modules/backend/behaviors/relationcontroller/partials/_manage_form.htm
index fcd03ef44..1321782f2 100644
--- a/modules/backend/behaviors/relationcontroller/partials/_manage_form.htm
+++ b/modules/backend/behaviors/relationcontroller/partials/_manage_form.htm
@@ -1,10 +1,11 @@
 <?php if ($relationManageId): ?>
 
-    <?= Form::ajax('onRelationManageUpdate', ['data-stripe-load-indicator' => true]) ?>
+    <?= Form::ajax('onRelationManageUpdate', ['data-stripe-load-indicator' => true, 'sessionKey' => $newSessionKey]) ?>
 
         <!-- Passable fields -->
-        <input type="hidden" name="_relation_field" value="<?= $relationField ?>" />
         <input type="hidden" name="manage_id" value="<?= $relationManageId ?>" />
+        <input type="hidden" name="_relation_field" value="<?= $relationField ?>" />
+        <input type="hidden" name="_relation_session_key" value="<?= $relationSessionKey ?>" />
 
         <div class="modal-header">
             <button type="button" class="close" data-dismiss="popup">&times;</button>
@@ -35,10 +36,11 @@
 
 <?php else: ?>
 
-    <?= Form::ajax('onRelationManageCreate', ['data-stripe-load-indicator' => true]) ?>
+    <?= Form::ajax('onRelationManageCreate', ['data-stripe-load-indicator' => true, 'sessionKey' => $newSessionKey]) ?>
 
         <!-- Passable fields -->
         <input type="hidden" name="_relation_field" value="<?= $relationField ?>" />
+        <input type="hidden" name="_relation_session_key" value="<?= $relationSessionKey ?>" />
 
         <div class="modal-header">
             <button type="button" class="close" data-dismiss="popup">&times;</button>