From 23883590c405a20a112a9c1a513bac898aab4234 Mon Sep 17 00:00:00 2001
From: thinkphp <thinkphp@qq.com>
Date: Thu, 18 May 2017 16:21:13 +0800
Subject: [PATCH] =?UTF-8?q?=E6=A8=A1=E5=9E=8B=E7=9A=84=E6=95=B0=E6=8D=AE?=
 =?UTF-8?q?=E4=B8=8D=E5=8F=97allowfield=E5=BD=B1=E5=93=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 library/think/Model.php | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/library/think/Model.php b/library/think/Model.php
index fb3ece2c..eeee9b36 100644
--- a/library/think/Model.php
+++ b/library/think/Model.php
@@ -943,18 +943,6 @@ abstract class Model implements \JsonSerializable, \ArrayAccess
             }
         }
 
-        // 检测字段
-        if (!empty($this->field)) {
-            if (true === $this->field) {
-                $this->field = $this->getQuery()->getTableInfo('', 'fields');
-            }
-            foreach ($this->data as $key => $val) {
-                if (!in_array($key, $this->field)) {
-                    unset($this->data[$key]);
-                }
-            }
-        }
-
         // 数据自动完成
         $this->autoCompleteData($this->auto);
 
@@ -990,6 +978,9 @@ abstract class Model implements \JsonSerializable, \ArrayAccess
                 $where = $this->updateWhere;
             }
 
+            // 检测字段
+            $this->checkAllowField($data);
+
             // 保留主键数据
             foreach ($this->data as $key => $val) {
                 if ($this->isPk($key)) {
@@ -1033,6 +1024,9 @@ abstract class Model implements \JsonSerializable, \ArrayAccess
                 return false;
             }
 
+            // 检测字段
+            $this->checkAllowField($this->data);
+
             $result = $this->getQuery()->insert($this->data);
 
             // 获取自动增长主键
@@ -1066,6 +1060,20 @@ abstract class Model implements \JsonSerializable, \ArrayAccess
         return $result;
     }
 
+    protected function checkAllowField(&$data)
+    {
+        if (!empty($this->field)) {
+            if (true === $this->field) {
+                $this->field = $this->getQuery()->getTableInfo('', 'fields');
+            }
+            foreach ($data as $key => $val) {
+                if (!in_array($key, $this->field)) {
+                    unset($data[$key]);
+                }
+            }
+        }
+    }
+
     protected function autoRelationUpdate($relation)
     {
         foreach ($relation as $name => $val) {