CODEWITHSUNDEEP
databasesecurityyiirelationship
Denis Kulagin
Denis Kulagin

Reputation: 8917

Yii: prevent sensitive data from loading via relations

For example I have a model called Entity and a model called User. Each entity BELONGS_TO a single user. Perfect case to establish a relationship.

Still user contains some sensitive data, like a password. How do I prevent those data to be loaded, when requesting entity-with-user?

P.S. I understand that its better to design your database schema separating auth data and publicly available data. E.g. store password in User model and username in Profile model. Still my question is how to maintain security in presented case.

Upvotes: 0

Views: 61

Answers (1)

Asped
Asped

Reputation: 3103

I think something like this could be used:

public function relations()
{

    return array(
            'user' =>  array(self::BELONGS_TO,'User','id_field','select'=>'name,surname,otherfield1,field2'),
    );
}

UPDATE

If you want to restrict the fields generally in the User model, you could try using defaultScope combined with using scenarios to determine when ALL fields can be selected.

public function defaultScope()
{
    if ( $this->scenario != 'yourScenario' ) {
      return array(
          'select'=>"name,surname,otherfield1,field2",
      );
    } else {
      return array();
    }      
}

Upvotes: 2

Related Questions