When attempting to retrieve the name from the 'users' table, the entire user object is being returned in the network tab. This leaks private information such as phone numbers which are stored in the users table.
Here is the Admin Model:
class Admin extends Model
{
protected $appends = ['name'];
public function user()
{
return $this->belongsTo('App\User');
}
public function getNameAttribute()
{
return $this->user?$this->user->name:'';
}
}
The Admin Controller looks like this:
public function ajaxLoadAdmins (Request $request)
{
$query = Admin::select('admins.slug', 'admins.about')->paginate(10);
return $admins;
}
However, when calling this function using ajax/axios, it returns the full user object along with the name and all columns of the users table.
I also attempted to simplify the code by not using accessors/mutators, but even with the following code the user object is still present when viewing in the network tab or logging it in the console...
public function ajaxLoadAdmins (Request $request)
{
$query = Admin::select('admins.slug', 'admins.about', 'users.name')->leftjoin('users','admins.user_id','=','users.id')->paginate(10);
return $admins;
}