Filament Withdrawals Laravel Package

Security fix - please upgrade.

Relation fields of withdrawal forms loaded any class and any column typed into the field editor. A field set to App\Models\User + password put the password hashes of every user into the withdrawal request form, and any class name had ::all() called on it.

• Relation fields now only read the models (or relationship names) and columns listed in the new relations allowlist of config/filament-withdrawals.php; anything else renders without options and is never queried
• Hidden model attributes (password, remember_token, anything in $hidden) are never shown, even when listed
• The field editor offers the allowlisted models and columns as selects and validates them on the server

Upgrade note: the allowlist is empty by default. If your withdrawal methods use relation fields, publish the config (php artisan vendor:publish --tag="filament-withdrawals-config") and add each model and column, for example:

'relations' => [
    \App\Models\Bank::class => ['name'],
],

Until then those fields show no options.

Full Changelog: https://github.com/tomatophp/filament-withdrawals/compare/v1.0.3...v4.0.0

• Add account column Full Changelog: https://github.com/tomatophp/filament-withdrawals/compare/v1.0.2...v1.0.3

• Wallet change integer to float Full Changelog: https://github.com/tomatophp/filament-withdrawals/compare/v1.0.1...v1.0.2

• fix wallet issue by @megoxv

Full Changelog: https://github.com/tomatophp/filament-withdrawals/compare/v1.0.0...v1.0.1

Full Changelog: https://github.com/tomatophp/filament-withdrawals/commits/v1.0.0