Filter out unneeded attributes on hasManyThrough relationship query

Level 27

@danielroenfeldt Anything wrong with using select()?

$photos = $car->photos()->select('a', 'b', ...)->get();
// or
$photos = $car->photos()->get(['a', 'b', ...]);

Level 10

@nimrod your solution is almost working. By that I mean:

I'm getting the fields I need, except for each photo's id field, which is also necessary. Adding this field into the array results in the following error:

Illuminate \ Database \ QueryException (23000)
SQLSTATE[23000]: Integrity constraint violation: 1052 Column 'id' in field list is ambiguous (SQL: select `id`, `filename`, `title`, `order`, `photo_galleries`.`car_id` as `laravel_through_key` from `photos` inner join `photo_galleries` on `photo_galleries`.`id` = `photos`.`photo_gallery_id` where `photo_galleries`.`car_id` = 35)

First issue aside, I'm still getting the laravel_through_key field, which I find to be a security risk, because it's exposing the Car's id to the outer world. Any thoughts on removing this one?

https://laravel.com/docs/8.x/eloquent-serialization#hiding-attributes-from-json

Level 27

@danielroenfeldt Regarding your first error, you have to be explicit which ID you want, since an ID column exists in photos and photo_galleries.

For example:

select('photos.id as photo_id')...

Second, you can use makeHidden on the result of your query to hide the column:

$result->makeHidden('laravel_through_key')

or add it to the hidden attributes:

1 like

Level 10

Okay, I'm one step closer :)

Being explicit in specifying the ID column helped. Never knew it was such a simple approach. Thank you!

However, makeHidden() seems to have zero effect on the query result. Moreover, I added this annoying laravel_through_key column to the hidden attributes as per your suggestion to each and all of my models (Car, PhotoGallery, as well as Photo). Yet again, nothing changed. What could be the reason?

Level 27

@danielroenfeldt makeHidden returns the new collection (without the specified attributes), did you consider that?

Level 10

Maybe I misunderstood your question, but here's my code

$car_photos = $car->photos()->get([  'photos.id as photo_id', 'filename', 'title', 'order' ]);
$car_photos->makeHidden('laravel_through_key');
dd( $car_photos );

Level 27

@danielroenfeldt It has to be

$car_photos = $car_photos->makeHidden('laravel_through_key');

Additionally you could simplify 'photos.id as photo_id' to 'photos.id as id' if you like.

1 like

Level 10

Same result 🤷‍♂️

$car_photos = $car->photos()->get([  'photos.id as id', 'filename', 'title', 'order' ]);
$car_photos = $car_photos->makeHidden('laravel_through_key');
dd( $car_photos );

Which outputs

Illuminate\Database\Eloquent\Collection {#1520 ▼
  #items: array:4 [▼
    0 => App\Photo {#1521 ▼
      #fillable: array:3 [▶]
      #hidden: array:2 [▶]
      #connection: "mysql"
      #table: "photos"
      #primaryKey: "id"
      #keyType: "int"
      +incrementing: true
      #with: []
      #withCount: []
      #perPage: 15
      +exists: true
      +wasRecentlyCreated: false
      #attributes: array:5 [▼
        "photo_id" => 113
        "filename" => "1611828914_HVqrHEKJxtonghqNotcVJFxq2LAxmPXTDSZUa43r.jpg"
        "title" => "A temporary title here. Needs to be handled later."
        "order" => 1
        "laravel_through_key" => 35
      ]
      #original: array:5 [▶]
      #changes: []
      #casts: []
      #dates: []
      #dateFormat: null
      #appends: []
      #dispatchesEvents: []
      #observables: []
      #relations: []
      #touches: []
      +timestamps: true
      #visible: []
      #guarded: array:1 [▶]
    }
    1 => App\Photo {#1522 ▶}
    2 => App\Photo {#1523 ▶}
    3 => App\Photo {#1524 ▶}
  ]
}

Level 27

@danielroenfeldt What Laravel version are you using? Either it's related to that or you have a bug in your code somewhere else, because for me both suggestions work just fine and I don't get the laravel_through_key in the first place (car_id instead).

Nvm, since you use dd() it's still visible. It should be hidden in your result tho.

1 like

Level 10

Output from php artisan --version

Laravel Framework 6.18.43

On a side note, I remember reading somewhere that ResourceCollections could be used to filter out unnecessary fields on items belonging to a given Collection. But I can't recall where I read that, nor can I find that article again. Any thoughts on that?

https://laravel.com/docs/6.x/eloquent-resources

Level 27

@danielroenfeldt Check my post above again. You could also use a resource class here, but for just one field it's a bit over the top imo.

1 like

Best Answer

Level 10

Oddly enough, using a PhotoResource did not fix the issue. I just ended up "spoofing" the car identifier by simply iterating over the collection's items with the help of the each() method of the Collection class, and simply setting the laravel_through_key field's value to an empty string. Obviously not the most elegant solution, but who cares, as long as it's removing the potentially vulnerable data 😁

$car_photos = $car->photos()->get([  'photos.id as id', 'filename', 'title', 'order' ]);
$car_photos->each(function( $photo ) {
  $photo->laravel_through_key = '';
});
dd( $car_photos );

Illuminate\Support\Collection {#1583 ▼
  #items: array:4 [▼
    0 => App\Photo {#1535 ▼
      #fillable: array:3 [▶]
      #hidden: array:2 [▶]
      #connection: "mysql"
      #table: "photos"
      #primaryKey: "id"
      #keyType: "int"
      +incrementing: true
      #with: []
      #withCount: []
      #perPage: 15
      +exists: true
      +wasRecentlyCreated: false
      #attributes: array:5 [▼
        "id" => 113
        "filename" => "1611828914_HVqrHEKJxtonghqNotcVJFxq2LAxmPXTDSZUa43r.jpg"
        "title" => "A temporary title here. Needs to be handled later."
        "order" => 1
        "laravel_through_key" => "" // <<<<< UNSAFE DATA REMOVED
      ]
      #original: array:5 [▶]
      #changes: []
      #casts: []
      #dates: []
      #dateFormat: null
      #appends: []
      #dispatchesEvents: []
      #observables: []
      #relations: []
      #touches: []
      +timestamps: true
      #visible: []
      #guarded: array:1 [▶]
    }
    1 => App\Photo {#1536 ▶}
    2 => App\Photo {#1537 ▶}
    3 => App\Photo {#1538 ▶}
  ]
}

@nimrod many thanks for your help! It's much appreciated.

chaudigv

Level 16

Use makeHidden() method.

$photos = $car->photos->makeHidden(['created_at', 'updated_at']); // these columns will be removed