Entenda como funciona
É sempre bom reforçar que segurança tem muito a ver com entender como as coisas funcionam.
Dica: Não é XSS.
<?php
// Arquivo: routes/web.php
use App\Http\Controllers\PostController;
use Illuminate\Support\Facades\Route;
Route::get('/posts/{id}', [PostController::class, 'get']);
Route::put('/posts/{id}', [PostController::class, 'put']);<?php
// Arquivo: app/Http/Requests/UpdatePostRequest.php
namespace App\Http\Requests;
use App\Models\Post;
use Illuminate\Foundation\Http\FormRequest;
class UpdatePostRequest extends FormRequest
{
/**
* Determine if the user is authorized to make this request.
*/
public function authorize(): bool
{
$postExists = Post::where('id', $this->id)
->where('author_id', $this->user()->id)
->exists();
return $postExists;
}
/**
* Get the validation rules that apply to the request.
*/
public function rules(): array
{
return [
'title' => 'required|string|max:64',
'content' => 'required|string|max:65535',
];
}
}<?php
// Arquivo: app/Http/Controllers/PostController.php
namespace App\Http\Controllers;
use App\Http\Requests\UpdatePostRequest;
use App\Models\Post;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
class PostController extends Controller
{
public function get(
Request $request,
int $postId
): JsonResponse {
$post = Post::where('author_id', $request->user()->id)
->findOrFail($postId);
return response()->json($post);
}
public function put(
UpdatePostRequest $request,
int $postId
): Response {
$post = Post::findOrFail($postId);
$post->update([
'title' => $request->title,
'content' => $request->content,
]);
return response()->noContent();
}
}