$model->update() and $model->save() updates all rows in a table when a primary key is not used

[plava]

Issue:

1. Create a MySQL table that does not use a primary key
2. Use $model = ModelClassName::findOne(['nonPK'=>'nonPKnumber']) or $model = ModelClassName::find->where(['nonPK'=>'nonPKnumber'])->one()
3. Set an attribute ($model->someColumnName = 'newValue')
4. Call $model->save() or $model->update()
5. All rows in the table at someColumnName will be updated to newValue

Expected outcome - only selected model should be updated.

[qiangxue]

What is the SQL statement executed?

[plava]

Is there a way to log the SQL statement executed? All I ran was:
$model = \common\models\PostReview::findOne(['post_id'=>'67709']);
$model->text = 'text';
$model->save();

[qiangxue]

You should override PostReview::primaryKey() to define primary keys. Otherwise you will meet the above problem.

However, from the framework point of view, it's better we throw an exception in this case to avoid updating/deleting all rows. Set for 2.0.1 since the change is not trivial and this is a corner case.

[ItsReddi]

argh. same here. now i know what was going on.
btw. i dont think that is an enhancement more a critical bug.

like he wrote...
he loaded an specific database entry.
the core methods should update only the loaded one.
This bug is proposed to be an massive data killer.