cakephp · ADmad · Mar 19, 2026
diff --git a/src/Controller/Component/FormProtectionComponent.php b/src/Controller/Component/FormProtectionComponent.php
@@ -142,6 +142,33 @@ public function implementedEvents(): array
         ];
     }
 
+    /**
+     * Unlock actions from validation.
+     *
+     * @param string|array<string> $actions Action or list of actions to unlock.
+     * @param bool $merge Whether to merge with existing unlocked actions or replace them.
+     * @return $this
+     */
+    public function unlockActions(string|array $actions, bool $merge = true)
+    {
+        return $this->setConfig('unlockedActions', (array)$actions, $merge);
+    }
+
+    /**
+     * Unlock fields from validation.
+     *
+     * Dot notation can be used to unlock nested fields. For example, `user.name`
+     * will unlock the `name` field in the `user` array.
+     *
+     * @param string|array<string> $fields Field or list of fields to unlock.
+     * @param bool $merge Whether to merge with existing unlocked fields or replace them.
+     * @return $this
+     */
+    public function unlockFields(string|array $fields, bool $merge = true)
+    {
+        return $this->setConfig('unlockedFields', (array)$fields, $merge);
+    }
+
     /**
      * Throws a 400 - Bad request exception or calls custom callback.
      *

diff --git a/tests/TestCase/Controller/Component/FormProtectionComponentTest.php b/tests/TestCase/Controller/Component/FormProtectionComponentTest.php
@@ -329,4 +329,40 @@ public function testClearingOfTokenFromRequestData(): void
 
         $this->assertSame([], $this->Controller->getRequest()->getParsedBody());
     }
+
+    /**
+     * Test unlockActions() method.
+     */
+    public function testUnlockActions(): void
+    {
+        // Single action as string
+        $this->FormProtection->unlockActions('index');
+        $this->assertSame(['index'], $this->FormProtection->getConfig('unlockedActions'));
+
+        // Multiple actions as array, merges by default
+        $this->FormProtection->unlockActions(['view', 'add']);
+        $this->assertSame(['index', 'view', 'add'], $this->FormProtection->getConfig('unlockedActions'));
+
+        // Replace when merge is false
+        $this->FormProtection->unlockActions('edit', false);
+        $this->assertSame(['edit'], $this->FormProtection->getConfig('unlockedActions'));
+    }
+
+    /**
+     * Test unlockFields() method.
+     */
+    public function testUnlockFields(): void
+    {
+        // Single field as string
+        $this->FormProtection->unlockFields('csrf_token');
+        $this->assertSame(['csrf_token'], $this->FormProtection->getConfig('unlockedFields'));
+
+        // Multiple fields as array, merges by default
+        $this->FormProtection->unlockFields(['debug', 'dynamic_field']);
+        $this->assertSame(['csrf_token', 'debug', 'dynamic_field'], $this->FormProtection->getConfig('unlockedFields'));
+
+        // Replace when merge is false
+        $this->FormProtection->unlockFields('new_field', false);
+        $this->assertSame(['new_field'], $this->FormProtection->getConfig('unlockedFields'));
+    }
 }