It's currently possible to update other objects rather than the to the form passed object by manipulating the primaryKey Hidden field in the html-code before submitting the form.

Symfony allready fixed this issue about a year ago in the standard sfPropelPlugin. I've noticed it was never fixed in sfPropel15Plugin. Would it be possible to fix this in sfPropel15Plugin too?

Best wishes,
Tschebel

Index: lib/generator/sfPropelFormGenerator.class.php
===================================================================
--- lib/generator/sfPropelFormGenerator.class.php   (revision 4333)
+++ lib/generator/sfPropelFormGenerator.class.php   (working copy)
@@ -328,10 +328,14 @@
         $name = 'Pass';
     }
 
-    if ($column->isPrimaryKey() || $column->isForeignKey())
+    if ($column->isForeignKey())
     {
       $name = 'PropelChoice';
     }
+    else if ($column->isPrimaryKey())
+    {
+      $name = 'Choice';
+    }
 
     return sprintf('sfValidator%s', $name);
   }
@@ -353,7 +357,7 @@
     }
     else if ($column->isPrimaryKey())
     {
-      $options[] = sprintf('\'model\' => \'%s\', \'column\' => \'%s\'', $column->getTable()->getClassname(), $this->translateColumnName($column));
+      $options[] = sprintf('\'choices\' => array($this->getObject()->get%s()), \'empty_value\' => $this->getObject()->get%1$s()', $this->translateColumnName($column, false, BasePeer::TYPE_PHPNAME));
     }
     else
     {