Skip to content

Commit

Permalink
attempt to fix 43893
Browse files Browse the repository at this point in the history
  • Loading branch information
taylorotwell committed Sep 12, 2022
1 parent 75ec9c3 commit eff2275
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 1 deletion.
12 changes: 11 additions & 1 deletion src/Illuminate/Database/Eloquent/Model.php
Original file line number Diff line number Diff line change
Expand Up @@ -441,7 +441,9 @@ public function fill(array $attributes)
{
$totallyGuarded = $this->totallyGuarded();

foreach ($this->fillableFromArray($attributes) as $key => $value) {
$fillable = $this->fillableFromArray($attributes);

foreach ($fillable as $key => $value) {
// The developers may choose to place some attributes in the "fillable" array
// which means only those attributes may be set through mass assignment to
// the model, and all others will just get ignored for security reasons.
Expand All @@ -455,6 +457,14 @@ public function fill(array $attributes)
}
}

if (count($attributes) !== count($fillable) &&
static::preventsSilentlyDiscardingAttributes()) {
throw new MassAssignmentException(sprintf(
'Add fillable property to allow mass assignment on [%s].',
get_class($this)
));
}

return $this;
}

Expand Down
4 changes: 4 additions & 0 deletions tests/Database/DatabaseEloquentModelTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -1291,10 +1291,14 @@ public function testGuarded()
$model = new EloquentModelStub;
$model->guard(['name', 'age']);
$model->fill(['Foo' => 'bar']);

Model::preventSilentlyDiscardingAttributes(false);
}

public function testFillableOverridesGuarded()
{
Model::preventSilentlyDiscardingAttributes(false);

$model = new EloquentModelStub;
$model->guard([]);
$model->fillable(['age', 'foo']);
Expand Down

0 comments on commit eff2275

Please sign in to comment.