LaraUtilX v1.5.3 Release Notes

Version 1.5.3 closes the gap left by 1.5.2, which restricted sorting in the abstract CrudController but not in the controllers make:crud generates. The generated path is the one this documentation steers people toward, so it was the more exposed of the two.

• Security
• Added
• Changed
• Upgrade Notes
• Tests
• Files Modified

Security

Generated controllers restrict sorting to an allow-list

The generated index() previously passed ?sort_by straight to orderBy():

if ($request->filled('sort_by')) {
    $query->orderBy($request->input('sort_by'), $request->input('sort_direction', 'asc'));
}

Any column on the table could be used to order results, letting a caller infer values from the row order for columns they could not otherwise read. Generated controllers now carry an explicit allow-list:

$sortable = ['id', 'title', 'body', 'created_at'];

if ($request->filled('sort_by') && in_array($request->input('sort_by'), $sortable, true)) {
    $direction = strtolower($request->input('sort_direction', 'asc')) === 'desc' ? 'desc' : 'asc';
    $query->orderBy($request->input('sort_by'), $direction);
}

The array is written into the method rather than added as a class property, so the publishable stubs are unchanged and the list stays visible and editable at the point of use.

See the API CRUD Generator documentation for details.

Added

The --sortable option sets the allow-list explicitly:

php artisan make:crud Post --fields="title:string,body:text" --sortable="title,created_at"

When omitted it defaults to id, the declared --fields, and created_at, with credential-looking columns excluded:

password, remember_token, api_token,
access_token, refresh_token, secret, token

Generating with --fields="title:string,password:string,body:text" therefore produces ['id', 'title', 'body', 'created_at'].

Changed

Generated controllers normalise ?sort_direction to asc or desc rather than passing the raw value to orderBy().

Upgrade Notes

Controllers generated before v1.5.3 are unaffected by this release, since the fix applies at generation time. If you have generated controllers in your application, add an allow-list to their index() methods or regenerate them with --force.

Existing make:crud invocations continue to work unchanged. If you relied on sorting a generated endpoint by a column outside the new default list, pass --sortable with the columns you want.

Tests

The suite grew from 175 to 179 tests, with new coverage for the default allow-list, the --sortable override, credential exclusion, and direction normalisation.

cd packages/omarchouman/lara-util-x
./vendor/bin/phpunit tests/Unit/Console/MakeCrudCommandTest.php

Files Modified