Fillable property on BaseModels

[lucasschirm]

I would like to suggest the fillable property show be keeped on Base files, and only be overloaded if nedded on Model files.

Are you accepting pull requests?

[CristianLlanos]

One reason to keep them in the user models is because if you want to overide the fillable property you will need to completely replace all those fields in each model. Whereas if you have them in the user models, it does not matter. You can change them (delete or add one field) or completely delete them if you don't need them.

For instance, your proposed behaviour would be like the following:

class BaseUser extends Eloquent
{
    protected $fillable = ['firstName', 'lastName', 'password', 'gender'];
}

class User extends BaseUser
{
    protected $fillable = ['firstName', 'lastName', 'password'];
}

If I wanted to add another field to my fillable property, I would need to write all the other fields as well. That isn't convenient at all.

However, if we have those fillable attributes in the User class, it'll be so easy to add a new field to the fillable property.

/** First generated model **/
class User extends BaseUser
{
    protected $fillable = ['firstName', 'lastName', 'password'];
}

/** You'll just need to add another field and that's it **/
class User extends BaseUser
{
    protected $fillable = ['firstName', 'lastName', 'password', 'gender'];
}

Another reason not to have new fields automatically added to the fillable property is because it can be dangerous. Since all new database fields will be automatically a fillable attribute, you don't get to decide weather you actually want it to be fillable or not. Remember that the reason for having fillable attributes is to defend yourself from mass assignment. If every new field is mass assignable by default, you are potentially creating security vulnerabilities in your system without even being aware of it.

[CristianLlanos]

Perhaps an option to enable one feature or another would be fine. The safer one should be the default and putting the fillable property in base models would have to be manually enabled. What do you think? Seems reasonable to me 🤔 And I'm willing to accept this pull request if you would like to contribute :)