Explicitly define $guarded=['id'] to prevent accidental insert? - php

Say I'd like to apply the following logic to all my Model class:
All Model class with auto incremental id should have protected $guarded = ['id']
So that I can't accidentally insert incremental id myself.
Does it makes sense in Laravel 5?
Do I have other ways to achieve it beside setting protected $guarded = ['id'] in each Model class?

If you follow the accepted answer, you can still manually set the id, and actually, I would actually say that answer makes your application's security worse.
Laravel already makes everything guarded by default:
protected $guarded = ['*'];
As a result, there's no need to specify the id when it's already guarded. When you override that property, you are telling Laravel, "Actually, don't guard everything. Only guard the properties that I specify." So essentially, you are unguarding other properties.
Also, if you are manually going to assign properties like this:
$model = new Model;
$model->id = 1;
$model->name = 'Example';
$model->save();
The $guarded / $fillable properties never kick in. They kick in when you use methods like create, update, fill, etc.

Yes, it still makes sense to do so. While ID is not fillable by default, it can be still overwritten when modified directly with $model->id = $id;
A better way is to define a base class for all your models and set the $guarded property there. This way you only need to do this once.
//Model.php
<?php namespace Your\Model\Namespace;
use Illuminate\Database\Eloquent\Model as Eloquent;
class Model extends Eloquent {
protected $guarded = ['id'];
}
//SomeModel.php
<?php namespace Your\Model\Namespace;
class SomeModel extends Model {}

Related

spatie/laravel-medialibrary change primary key

I'm using the package spatie/laravel-medialibrary and I want to change the primaryKey on their modal called Media, without editing the package src file.
In my project, I'm using uuids as primary keys for all my models, so naturally, I want to do the same thing for the Media.php model offered by this package.
I already changed the migration to reflect that, by removing the line $table->bigInteger('id') and changing the line $table->uuid('uuid')->nullable(); to table->uuid('uuid')->unique()->primary();
However, now I also want to let the model know I'm using a different key, by setting up protected $primaryKey = 'uuid'; and protected $keyType = 'string'; but I can't find a way to do this outside the packages src file for the Media.php model
Basically, what I want to end up doing is just implementing the HasMedia interface and using the InteractsWithMedia trait on my Profile model, like this:
<?php
namespace App;
use Illuminate\Database\Eloquent\Model;
use Spatie\MediaLibrary\HasMedia;
use Spatie\MediaLibrary\InteractsWithMedia;
class Profile extends Model implements HasMedia
{
use InteractsWithMedia;
}
Any suggestions on how to achieve this?
Thanks.
Spatie's medialibrary package gives you the option to use your own media model, as described in their docs.
Just create your custom model and extend the library's Media model. You can then modify that csutom model to fit your needs.
use Spatie\MediaLibrary\MediaCollections\Models\Media as BaseMedia;
class Media extends BaseMedia
{
protected $primaryKey = 'uuid';
protected $keyType = 'string';
public $incrementing = false;
// ...
}
Remember to set the media_model key in config/media-library.php to your model's FQCN.
'media_model' => App\YourMediaModel::class,

Extending Eloquent models, more magic methods

Situation: In my work they have conventions on their database, table and column names, which are a bit long and repetitive. Being used to Eloquent I figured it wouldn't be much trouble to reimplement __get and __set methods, and not making lots of getters. Something like this (toConvention implements company's conventions):
use Illuminate\Database\Eloquent\Model;
class CompanyModel extends Model {
public function __get($key){
return $this->getAttribute($this->toConvention($key));
}
public function __set($key){
return $this->setAttribute($this->toConvention($key));
}
}
Which works well, for retrieving attributes, but not for retrieving relationships. Here are the implementations:
use App\CompanyModel as Model
class Location extends Model
{
protected $table = 'tablename';
protected $primaryKey = 'primarykeycolumn';
//...
public function comissionCurrency(){
return $this->belongsTo('App\Currency', 'foreign', 'other');
}
}
use App\CompanyModel as Model
class Currency extends Model
{
protected $table = 'tablename';
protected $primaryKey = 'primarykeycolumn';
//...
}
When requesting for attributes, like $location->name, or $location->comission_currency_id everything works as expected, retrieving the corresponding column name. But when I try to retrieve the belongsTo relationship, after using toSql() I see almost the correct query formed: select * from table where table.column is null the is null part should be comparing with the corresponding id.
I know it's due to my implementation, because when I use Illuminate\Database\Eloquent\Model everything works ok. Funny thing is that when I use Eloquent's model on the child model and the reimplemented on the other, it works to (but I'm not able to use my magic methods in the child model, in the parent one fetched from the relationship I can...)
I haven't figured out which method to reimplement to make this work by reading Eloquent's code, any ideas, or suggestions?
Thanks in advance.

Laravel Dynamic Fillable in Models

Got stuck in a issue with laravel 5.2.
Following is the error during eloquent create operation(post call),
Mass Assignment Exception in Model.php 453: column_name
Following are the prerequisites, which are to be taken into consideration:
Fillables in model are filled in a dynamic manner by the following code:
public function __construct() {
$this->fillable(\Schema::getColumnListing($this->getTable()))
}
Following are the methods which are debugged till now:
Before insertion, in controller, $model::getillableField(), gives proper fillable array.
In model.php line(450),
if ($this->isFillable($key)) {
$this->setAttribute($key, $value);
}
the above code returns the value as "false" and $model::getFillableField() has the column_name in the array list.
Hardcoding $fillable variable with columns of table removes the error.
Please Help, where i am going wrong and what is the solution for it?
Thanks in advance.
What you are really trying to do is make ALL fields fillable.
The correct way to do this in Laravel is this:
protected $guarded = [];
This works in 5.2, even though the documentation for it is found in 5.3.
(relevant source code for 5.2)
(Documentation from 5.3):
If you would like to make all attributes mass assignable, you may define the $guarded property as an empty array:
By setting $guarded to an empty array, you are creating an empty black list, allowing all fields to be mass assignable.
Also, if this model is ever going to be constructed directly from user input, please do not do this. Laravel requires either $fillable or $guarded to be defined for a reason. Unless your model has fields that are literally 1:1 with a public form, then allowing all fields to be writable on mass assignment is a security vulnerability.
Try this.
Put the below code in your model,
public function __construct()
{
$this->setFillable();
}
public function setFillable()
{
$fields = \Schema::getColumnListing('table_name_here');
$this->fillable[] = $fields;
}
This makes each and every column is fillable from that table.
Create a trait that uses the database columns.
<?php
namespace App\Traits;
use Illuminate\Support\Facades\Schema;
trait ColumnFillable
{
public function getFillable()
{
return Schema::getColumnListing($this->getTable());
}
}
Now use this trait in your models.
<?php
namespace App;
use App\Traits\ColumnFillable;
class MyModel extends Model
{
use ColumnFillable;
...
Now you'll never have to manually specify $fillable.

Retrieving all children and grandchildren of Laravel models

I have several models, all of which need the one before it to be accessed. The examples below describe a similar situation
<?php namespace backend\Models;
use Illuminate\Database\Eloquent\Model;
class Geo_Locations extends Model {
protected $table = 'geo_locations';
protected $fillable = ['id', 'name', 'population', 'square_miles', 'comments'];
public function state(){
return $this->hasMany('backend\Models\Geo_State', 'id', 'state_id');
}
}
The "Geo_State" model
<?php namespace backend\Models;
use Illuminate\Database\Eloquent\Model;
class Geo_State extends Model {
protected $table = 'geo_states';
protected $fillable = ['id', 'name', 'political_obligation', 'comments'];
public function city(){
return $this->hasMany('backend\Models\Geo_City', 'id', 'city_id');
}
}
And then the "Geo_City" model would be
<?php namespace backend\Models;
use Illuminate\Database\Eloquent\Model;
class Geo_City extends Model {
protected $table = 'geo_cities';
protected $fillable = ['id', 'name', 'population', 'comments'];
public function miles(){
return $this->hasMany('backend\Models\Geo_Mile', 'id', 'mile_marker');
}
}
and it can continues but for the sake of ease, I'll stop there. What I would like to accomplish, and I'm sure many others would as well. Would be a way to retrieve all data related to one of the main models. For example, I want to get all the cities and their respective states within a location. What I would like for a result is something like
print_r(json_encode($a->getChildren(), JSON_PRETTY_PRINT));
should print out
{
"Geo_Location":{
"name":"United States",
"population":"300 Some Million",
"comments":"they have a lot of issues",
"Geo_State":{
"name":"Texas",
"population":"Some big number",
"comments":"they have a lot of republicans",
"Geo_City":{
"name":"Dallas",
"population":"A lot",
"comments":"Their food is awesome"
}
}
}
}
I have some of the code in a gist, while it may be poorly documented it's all I've been working with and it's my third attempt at doing this.
Individual calls to the route /api/v1/locations/1 would return all the info for United States but will leave out the Geo_State and below. A call to /api/v1/state/1 will return Texas's information but will leave out the Geo_Location and the Geo_City.
The issue in what I have is that it's not recursive. If I go to the route /api/v1/all it's suppose to return a json array similar to the desired one above, but it's not getting the children.
It sounds like what you want is to load the relationships the model has when you call that model. There are two ways I know you can do that in laravel using eager loading.
First way is when you retrieve the model using the with parameter, you can add the relationship and nested relationships like below.
$geoLocationCollectionObject =
Geo_Location::with('state', 'state.city', 'state.city.miles', 'etc..')
->where('id', $id)
->get();
This will return a collection object - which has a function to return the json (toJson). I'm not sure how it handles the relationships (what your calling children) so you may need to make a custom function to parse the collection object and format it how you've specified.
toJson Function
Second option is similar to the first but instead you add the with parameter (as protected $with array) to the model so that the relationships are loaded everytime you call that model.
Geo_Location class
protected $with = array('state');
Geo_State class
protected $with = array('city');
Geo_City class
protected $with = array('miles');
etc...
Now when you retrieve a Geo_Location collection object (or any of the others) the relationship will already be loaded into the object, I believe it should be recursive so that the city miles will also be called when you get a state model for instance - but haven't tested this myself so you may want to verify that.
I use ChromeLogger to output to the console and check this myself.
If you do end up needing a custom json_encode function you can access the relationship by doing $geoLocation->state to retreive all states and then for each state $state->city etc... See the docs for more info.
Laravel Docs on Eager Loading
I wasn't really sure what was going on in the code you linked, but hopefully this helps some.
So after a bit of fiddling around, turns out that what I am looking for would be
Geo_Locations::with('state.city')->get();
Where Geo_Locations is the base model. The "state" and the "city" would be the relations to the base model. If I were to return the query above, I would end up getting an json array of what I am looking for. Thank you for your help Anoua
(To make this more dynamic I'm going to try to find a way to get all of the names of the functions to automate it all to keep on track with what my goal is. )

Temporary property for Laravel Eloquent model

I have a Laravel Eloquent model User, which has a table with username and email columns. I need to add a property for the model on runtime, something like $user->secure. This property doesn't need to go to database.
When i add this property and hit $user->save() i get an error saying i don't have database column 'secure'. I can unset 'secure' before save but somehow it feels there should be a better way to do so. Any suggestions?
Just add an attribute to your class.
class User extends Eloquent {
public $secure;
// ...
}
Note that it is better to declare it protected and add corresponding accessors and mutators (getSecure and setSecure methods) to your model.
For those who still find this post (like I did), you may need to explicitly declare the property as null to prevent it from being automatically added to the attributes array, and thus being added to INSERT/UPDATE queries:
class User extends Eloquent {
public $secure = null;
// ...
}
Source: http://laravel.io/forum/02-10-2014-setting-transient-properties-on-eloquent-models-without-saving-to-database
If you intend to make use of that add-on property, then $append will blow your mind.
http://laraveldaily.com/why-use-appends-with-accessors-in-eloquent/

Categories