Fields in the __hidden__ variable are being returned.

[jpmateo022]

May I know if we also applied the hidden which indicates what fields should not be returned in the query? My password field shows up after I call the create method.

[jpmateo022]

Update:

It seems it's not totally not working. I think this is can be also a security issue since tables that contains password fields might get exposed.

[girardinsamuel]

@jpmateo022 __hidden__ attribute on model is here to hide fields when serializing your model:

class User(Model):
    __hidden__ = ["password"]
# ..
user=User.find(1)
user.serialize() #== won't contain password field

This does not remove the fields from query

[jpmateo022]

Yep even I serialized the hidden fields are still showing.

[girardinsamuel]

But that was not the goal of this __hidden__ attribute which is working correctly

class User(Model):
    __hidden__ = ["password", "email"]
# ..
user=User.find(1)
user.serialize()
# will return 
{'id': 1, 'name': 'Sam', 'remember_token': None, 'verified_at': '2021-01-24T19:25:27.870415+00:00', 'created_at': '2021-01-24T18:25:27+00:00', 'updated_at': '2021-01-24T18:25:27+00:00'}

Please check this open issue #302 as I think is related to what you would like to have. If not could you add more details here to explain the behaviour you would like to have (with code examples) ?
Thanks 👍

[josephmancuso]

I tested this myself and cannot replicate. Will close for now but will reopen if there is additional information

[josephmancuso]

@girardinsamuel @jpmateo022 I think what you might be interested in is using __selects__ on your models https://orm.masoniteproject.com/models#selecting