How to protect Laravel model properties

Question

When working with other frameworks, or pure-PHP, I protect my model properties. I then create public getters and setters where required, and proxy to them using __get() and __set(). This helps me sleep at night.

Recently I started using Laravel and I am surprised at how 'unprotected' the Eloquent models are. I understand that I can use the $guarded and $fillable properties to control mass assignment, but that still leaves a lot of room for accidental access.

For example, my model has a status property. It has a default value set on model creation, and should only be modified when $model->activate() or $model->deactivate() is called. But by default, Laravel allows developers to modify it directly. As far as I can see, the only way to prevent this is to create a setter, and throw an exception if it is called.

Am I missing something? Perhaps I just need to relax? What's the best way to build Eloquent models that are secure by default?

Hakan SONMEZ Hakan SONMEZ · Accepted Answer · 2017-09-23T06:48:17

You can override __get and __set method. You need to define an array protectedProperties and a boolean variable protectedChecks so you can control the model fields.

protected $protectedChecks = true;

protected $protectedProperties = [ 'status' ];

protected $fillable = ['status'];

public function __get($key)
{
    return (in_array($key, $this->fillable) && !in_array($key, $this->protectedProperties)) ? $this->attributes[$key] : null;
}

public function __set($key, $value)
{
    if(!$this->protectedChecks || !in_array($key, $this->protectedProperties))
            return parent::__set($key, $value);
        trigger_error('Protected Field');
}

public function activate()
{
    $this->protectedChecks = false;
    $this->status = 1;
    $this->save(); // this is optional if you want to save the model immediately
    $this->protectedChecks = true;
}

If you want to use every model you should write something like above in BaseModel.

How to protect Laravel model properties

3 Answers