Index: branches/5.3.x/core/kernel/db/db_event_handler.php
===================================================================
diff -u -N -r16002 -r16111
--- branches/5.3.x/core/kernel/db/db_event_handler.php	(.../db_event_handler.php)	(revision 16002)
+++ branches/5.3.x/core/kernel/db/db_event_handler.php	(.../db_event_handler.php)	(revision 16111)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: db_event_handler.php 16002 2013-12-03 09:18:18Z alex $
+* @version	$Id: db_event_handler.php 16111 2014-12-07 14:49:01Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -398,30 +398,6 @@
 		}
 
 		/**
-		 * Returns fields, that are not allowed to be changed from request
-		 *
-		 * @param Array $hash
-		 * @return Array
-		 * @access protected
-		 */
-		protected function getRequestProtectedFields($hash)
-		{
-			// by default don't allow changing ID or foreign key from request
-			$config = $this->getUnitConfig();
-
-			$fields = Array ();
-			$fields[] = $config->getIDField();
-
-			$parent_prefix = $config->getParentPrefix();
-
-			if ( $parent_prefix && !$this->Application->isAdmin ) {
-				$fields[] = $config->getForeignKey($parent_prefix);
-			}
-
-			return $fields;
-		}
-
-		/**
 		 * Removes any information about current/selected ids
 		 * from Application variables and Session
 		 *
@@ -1573,7 +1549,8 @@
 			}
 
 			list($id, $field_values) = each($items_info);
-			$object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values));
+			$object->setID($id);
+			$object->SetFieldsFromHash($field_values);
 			$event->setEventParam('form_data', $field_values);
 
 			$this->customProcessing($event, 'before');
@@ -1588,7 +1565,6 @@
 			$event->redirect = false;
 			$event->status = kEvent::erFAIL;
 			$this->Application->SetVar($event->getPrefixSpecial() . '_SaveEvent', 'OnCreate');
-			$object->setID($id);
 		}
 
 		/**
@@ -1627,7 +1603,7 @@
 			if ( $items_info ) {
 				foreach ($items_info as $id => $field_values) {
 					$object->Load($id);
-					$object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values));
+					$object->SetFieldsFromHash($field_values);
 					$event->setEventParam('form_data', $field_values);
 					$this->customProcessing($event, 'before');
 
@@ -2203,8 +2179,9 @@
 			$object = $event->getObject( Array('skip_autoload' => true) );
 			/* @var $object kDBItem */
 
+			$object->setID(0);
 			$field_values = $this->getSubmittedFields($event);
-			$object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values));
+			$object->SetFieldsFromHash($field_values);
 			$event->setEventParam('form_data', $field_values);
 			$this->customProcessing($event, 'before');
 
@@ -2215,7 +2192,6 @@
 			else {
 				$event->status = kEvent::erFAIL;
 				$event->redirect = false;
-				$object->setID(0);
 			}
 		}
 
@@ -2636,6 +2612,11 @@
 						$file_helper = $this->Application->recallObject('FileHelper');
 						/* @var $file_helper FileHelper */
 
+						if ( !file_exists($data['file']) ) {
+							// file removal was requested too
+							continue;
+						}
+
 						$old_name = basename($data['file']);
 						$new_name = $file_helper->ensureUniqueFilename(dirname($data['file']), kUtil::removeTempExtension($old_name));
 						rename($data['file'], dirname($data['file']) . '/' . $new_name);
@@ -3280,7 +3261,7 @@
 
 			list ($id, $field_values) = each($items_info);
 			$object->Load($id);
-			$object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values));
+			$object->SetFieldsFromHash($field_values);
 			$event->setEventParam('form_data', $field_values);
 			$object->setID($id);
 
@@ -3464,4 +3445,4 @@
 		{
 			$event->setEventParam('constrain_info', Array ('', ''));
 		}
-	}
\ No newline at end of file
+	}