fix(security): prevent payment gateway credentials leakage via OrderResource

Author: xboard

app/Http/Controllers/V2/Admin/PaymentController.php

@@ -25,7 +25,7 @@ public function getPaymentMethods()
 
     public function fetch()
     {
-        $payments = Payment::orderBy('sort', 'ASC')->get();
+        $payments = Payment::orderBy('sort', 'ASC')->get()->makeVisible('config');
         foreach ($payments as $k => $v) {
             $notifyUrl = url("/api/v1/guest/payment/notify/{$v->payment}/{$v->uuid}");
             if ($v->notify_domain) {

app/Http/Resources/OrderResource.php

@@ -23,6 +23,12 @@ public function toArray(Request $request): array
             ...parent::toArray($request),
             'period' => PlanService::getLegacyPeriod((string)$this->period),
             'plan' => $this->whenLoaded('plan', fn() => PlanResource::make($this->plan)),
+            'payment' => $this->whenLoaded('payment', fn() => $this->payment ? [
+                'id' => $this->payment->id,
+                'name' => $this->payment->name,
+                'payment' => $this->payment->payment,
+                'icon' => $this->payment->icon,
+            ] : null),
         ];
     }
 }

app/Models/Payment.php

@@ -15,4 +15,8 @@ class Payment extends Model
         'config' => 'array',
         'enable' => 'boolean'
     ];
+
+    protected $hidden = [
+        'config',
+    ];
 }

app/Services/PaymentService.php

@@ -29,14 +29,14 @@ public function __construct($method, $id = NULL, $uuid = NULL)
             if (!$paymentModel) {
                 throw new ApiException('payment not found');
             }
-            $payment = $paymentModel->toArray();
+            $payment = $paymentModel->makeVisible('config')->toArray();
         }
         if ($uuid) {
             $paymentModel = Payment::where('uuid', $uuid)->first();
             if (!$paymentModel) {
                 throw new ApiException('payment not found');
             }
-            $payment = $paymentModel->toArray();
+            $payment = $paymentModel->makeVisible('config')->toArray();
         }
 
         $this->config = [];