Hi,

I have recently come across a very weird behaviour. I looked at http://doc.silverstripe.org/framework/en/topics/forms and a few other sources and it is very clear that form actions should not specifically be put in the allowed_actions array, as adding the form will automatically give the action permission.

When you return a form to a page as in "Form"=>$this->CustomForm(), you only have to add the CustomForm in the allowed_actions array, and not the action. But when you call $CustomForm from a template, you require both the CustomForm as well as the action to be in the allowed_actions. Why is this?

//returning a form

//class initlalization
$allowed_actions = array(
    "CustomForm",
    "something
);

function CustomForm(){
//some form here
}

function something(){
    return array("Form"=>$this->CustomForm());
}

//in the Page_something.ss
$Form

//calling a form

//class initlalization
$allowed_actions = array(
    "CustomForm",
    "doSubmitCustom",
    "something
);

function CustomForm(){
//some form here
}

//in the Page.ss
$CustomForm

I can only assume that calling the Form from the template would result in the same behaviour as calling an action directly through an href link, in which case the action is required to be in the allowed actions, but why do it with the form if a post is being done anyways?