Guest Entries Laravel Package

Getting Started

• Install/upgrade with composer require <vendor>/<package>:^5.2.1 — treat 5.2.1 as the minimum version; the 5.2.x line closes several upload, lookup, and mass-assignment issues, so pinning below it is not advisable on any public-facing install.
• Publish the config (php artisan vendor:publish) and read it before writing code. The two knobs that matter most day-to-day are the validation toggle and the guest-submission settings — they change the shape of every request you send.
• Skim the package's route registration to see exactly which endpoints exist (index/show/store/update/destroy for entries, plus the asset upload/attach routes). This is faster than inferring behaviour from the docs.
• First use case to get working end-to-end: an authenticated POST that creates an entry with one file upload, then a PATCH that updates it. That single loop exercises entry lookup, validation, file handling, and asset path resolution — the four areas this release hardened.
• Second use case: a guest submission through the same store endpoint, submitting only the fields you explicitly allow. Do not skip this; guest handling is where the behavioural changes in 5.2.1 are most visible.

Implementation Patterns

Entry CRUD

• Use the endpoints as thin transport and keep business logic in your own Actions/Events. The package is the I/O layer; don't let it become the place where publishing rules live.
• Be deliberate about the identifier you pass to update/destroy. Since lookups were hardened, sending the wrong identifier type (ID where a slug/handle is expected, or a soft-deleted/stale ID) now fails closed rather than silently resolving. Make your frontend send back exactly the identifier the store/index response gave you.
• Treat 404 on update/destroy as "not found or not visible to you" — do not branch UX on the distinction.

Validation

• Keep validation enabled for any endpoint reachable by untrusted clients. That's the intended path and gets you the field-level error messages.
• If you deliberately disable validation (e.g. an internal, trusted publisher API), note that 5.2.1 sanitizes the parameters anyway. Your request is no longer a passthrough — anything not recognised by the entry's field configuration is dropped. Declare custom fields in the blueprint/fieldset if you need them to survive.
• Handle 422 generically. Invalid input is normalised now, so error text/keys are less specific than before; don't parse them, map them.

File uploads and assets

• Always send uploads as multipart/form-data, and store the asset reference the package returns rather than reconstructing a path from the filename. Path-based references are the exact thing hardened in #122.
• If you have pre-existing content with asset paths stored as strings, write one smoke test that renders/reads a legacy entry after upgrade. This is the most likely place for a quiet regression in your own app.
• Configure accepted MIME types and extensions explicitly in config instead of relying on defaults; hardening tightened what will be accepted, and your previously-working upload test may now 422.

Guest submissions

• Model guest access as an explicit allowlist of entry fields. Reserved fields (authorship, publication state, identifiers, dates) are now blocked for guests — so move those values server-side: set them in a saving/creating listener, a form request's prepareForValidation, or an Action that wraps the submission.
• If a guest submission "succeeds" but a field is empty, that's the reserved-field block working as designed, not a bug — check your payload against the reserved list first.

Testing

• Use Laravel's HTTP client with actingAs() for the authenticated path and bare requests for the guest path. Add regression tests for: invalid entry ID on update/destroy, guest attempting a reserved field, an SVG upload, and an upload with a disallowed extension. Those four tests cover the entirety of this release.

Gotchas and Tips

• Silent field stripping is the #1 debugging trap. Both the guest reserved-field block and the validation-disabled parameter sanitisation drop data without erroring. When a stored entry is missing data, log the raw request payload next to the persisted model before you touch anything else.
• "Validation disabled" no longer means "unfiltered". If you had an internal tool leaning on validation being off to push arbitrary keys through, it will break quietly. Audit those callers on upgrade.
• SVG sanitization got stricter. Standard shapes, paths, and gradients are fine; external references, xlink:href to remote resources, embedded scripts, and some filter/animation primitives may be stripped. If you serve SVG icons/sprites through this package, diff a sanitized output against the original once, then decide whether to keep SVG or pre-rasterise.
• Upload rejections are now broader. Files that previously squeaked through (double extensions, mismatched MIME, polyglot files) will be refused. Check your app's accepted-types config before assuming a bug.
• Clear caches after upgrading — php artisan config:clear route:clear — since config and route registration changed behaviour in this line. On production, re-run config:cache/route:cache.
• Don't wrap the package's controllers to "restore" old behaviour. The pre-5.2.1 lookup and parameter handling is the vulnerability. If you need flexibility, add a middleware or a form request in front of the route, or a listener after it — never fork the lookup logic.
• Extension points worth knowing: model/entry events for injecting reserved values, middleware for guest rate-limiting and abuse control, and policies/gates for per-entry authorization. These let you stay on the hardened defaults while still supporting custom workflows.
• Watch the changelog cadence. Seven hardening PRs in one patch release signals active security review; subscribe to releases and budget a regression pass on every 5.2.x bump rather than treating patch versions as no-ops.