Index: branches/5.2.x/core/kernel/db/db_event_handler.php
===================================================================
diff -u -N -r15045 -r15049
--- branches/5.2.x/core/kernel/db/db_event_handler.php	(.../db_event_handler.php)	(revision 15045)
+++ branches/5.2.x/core/kernel/db/db_event_handler.php	(.../db_event_handler.php)	(revision 15049)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: db_event_handler.php 15045 2012-01-16 13:56:58Z alex $
+* @version	$Id: db_event_handler.php 15049 2012-01-16 15:22:04Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -402,6 +402,29 @@
 		}
 
 		/**
+		 * Returns fields, that are not allowed to be changed from request
+		 *
+		 * @param Array $hash
+		 * @return Array
+		 * @access protected
+		 */
+		protected function getRequestProtectedFields($hash)
+		{
+			// by default don't allow changing ID or foreign key from request
+			$fields = Array ();
+			$fields[] = $this->Application->getUnitOption($this->Prefix, 'IDField');
+
+			$parent_prefix = $this->Application->getUnitOption($this->Prefix, 'ParentPrefix');
+
+			if ( $parent_prefix ) {
+				$foreign_key = $this->Application->getUnitOption($this->Prefix, 'ForeignKey');
+				$fields[] = is_array($foreign_key) ? $foreign_key[$parent_prefix] : $foreign_key;
+			}
+
+			return $fields;
+		}
+
+		/**
 		 * Removes any information about current/selected ids
 		 * from Application variables and Session
 		 *
@@ -1514,7 +1537,7 @@
 			$items_info = $this->Application->GetVar( $event->getPrefixSpecial(true) );
 			if ($items_info) {
 				list($id,$field_values) = each($items_info);
-				$object->SetFieldsFromHash($field_values);
+				$object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values));
 			}
 
 			$this->customProcessing($event,'before');
@@ -1569,7 +1592,7 @@
 			if ( $items_info ) {
 				foreach ($items_info as $id => $field_values) {
 					$object->Load($id);
-					$object->SetFieldsFromHash($field_values);
+					$object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values));
 					$this->customProcessing($event, 'before');
 
 					if ( $object->Update($id) ) {
@@ -2091,7 +2114,8 @@
 			$object =& $event->getObject( Array('skip_autoload' => true) );
 			/* @var $object kDBItem */
 
-			$object->SetFieldsFromHash( $this->getSubmittedFields($event) );
+			$field_values = $this->getSubmittedFields($event);
+			$object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values));
 
 			$this->customProcessing($event, 'before');
 
@@ -3152,7 +3176,7 @@
 
 			list ($id, $field_values) = each($items_info);
 			$object->Load($id);
-			$object->SetFieldsFromHash($field_values);
+			$object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values));
 			$object->setID($id);
 
 			$response = Array ('status' => 'OK');