Entenda como funciona
É sempre bom reforçar que segurança tem muito a ver com entender como as coisas funcionam.
Dica: Não é XSS.
<?php
// Arquivo: routes/web.php
use App\Http\Controllers\PostController;
use Illuminate\Support\Facades\Route;
'/posts/{id}', [PostController::class, 'get']);
Route::get('/posts/{id}', [PostController::class, 'put']); Route::put(
<?php
// Arquivo: app/Http/Requests/UpdatePostRequest.php
namespace App\Http\Requests;
use App\Models\Post;
use Illuminate\Foundation\Http\FormRequest;
class UpdatePostRequest extends FormRequest
{/**
* Determine if the user is authorized to make this request.
*/
public function authorize(): bool
{$postExists = Post::where('id', $this->id)
'author_id', $this->user()->id)
->where(;
->exists()
return $postExists;
}
/**
* Get the validation rules that apply to the request.
*/
public function rules(): array
{return [
'title' => 'required|string|max:64',
'content' => 'required|string|max:65535',
;
]
} }
<?php
// Arquivo: app/Http/Controllers/PostController.php
namespace App\Http\Controllers;
use App\Http\Requests\UpdatePostRequest;
use App\Models\Post;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
class PostController extends Controller
{public function get(
$request,
Request int $postId
: JsonResponse {
)$post = Post::where('author_id', $request->user()->id)
$postId);
->findOrFail(
return response()->json($post);
}
public function put(
$request,
UpdatePostRequest int $postId
: Response {
)$post = Post::findOrFail($postId);
$post->update([
'title' => $request->title,
'content' => $request->content,
;
])
return response()->noContent();
} }