diff --git a/library/think/Collection.php b/library/think/Collection.php
index 9561e28f..68097131 100644
--- a/library/think/Collection.php
+++ b/library/think/Collection.php
@@ -40,10 +40,10 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
         return empty($this->items);
     }
 
-    public function toArray()
+    public function toArray($allow = [])
     {
         return array_map(function ($value) {
-            return ($value instanceof Model || $value instanceof self) ? $value->toArray() : $value;
+            return ($value instanceof Model || $value instanceof self) ? $value->toArray($allow) : $value;
         }, $this->items);
     }
 
@@ -74,7 +74,6 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
         return new static(array_diff($this->items, $this->convertToArray($items)));
     }
 
-
     /**
      * 交换数组中的键和值
      *
@@ -116,7 +115,6 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
         return array_pop($this->items);
     }
 
-
     /**
      * 通过使用用户自定义函数，以字符串返回数组
      *
@@ -199,7 +197,6 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
         return $this;
     }
 
-
     /**
      * 用回调函数过滤数组中的元素
      * @param callable|null $callback
@@ -228,13 +225,13 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
 
         $result = [];
         foreach ($this->items as $row) {
-            $key    = $value = null;
+            $key    = $value    = null;
             $keySet = $valueSet = false;
-            if ($index_key !== null && array_key_exists($index_key, $row)) {
+            if (null !== $index_key && array_key_exists($index_key, $row)) {
                 $keySet = true;
-                $key    = (string)$row[$index_key];
+                $key    = (string) $row[$index_key];
             }
-            if ($column_key === null) {
+            if (null === $column_key) {
                 $valueSet = true;
                 $value    = $row;
             } elseif (is_array($row) && array_key_exists($column_key, $row)) {
@@ -252,7 +249,6 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
         return $result;
     }
 
-
     /**
      * 对数组排序
      *
@@ -275,7 +271,6 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
         return new static($items);
     }
 
-
     /**
      * 将数组打乱
      *
@@ -349,12 +344,13 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
     /**
      * 转换当前数据集为JSON字符串
      * @access public
-     * @param integer $options json参数
+     * @param array     $allow 允许输出的属性列表
+     * @param integer   $options json参数
      * @return string
      */
-    public function toJson($options = JSON_UNESCAPED_UNICODE)
+    public function toJson($allow = [], $options = JSON_UNESCAPED_UNICODE)
     {
-        return json_encode($this->toArray(), $options);
+        return json_encode($this->toArray($allow), $options);
     }
 
     public function __toString()
@@ -373,6 +369,6 @@ class Collection implements ArrayAccess, Countable, IteratorAggregate, JsonSeria
         if ($items instanceof self) {
             return $items->all();
         }
-        return (array)$items;
+        return (array) $items;
     }
-}
\ No newline at end of file
+}
diff --git a/library/think/Model.php b/library/think/Model.php
index 0a60ae84..7e7fdcb9 100644
--- a/library/think/Model.php
+++ b/library/think/Model.php
@@ -472,9 +472,10 @@ abstract class Model implements \JsonSerializable, \ArrayAccess
     /**
      * 转换当前模型对象为数组
      * @access public
+     * @param array $allow 允许输出的属性列表
      * @return array
      */
-    public function toArray()
+    public function toArray($allow = [])
     {
         $item = [];
         if (!empty($this->append)) {
@@ -482,9 +483,13 @@ abstract class Model implements \JsonSerializable, \ArrayAccess
                 $item[$name] = $this->getAttr($name);
             }
         }
+        if (empty($allow)) {
+            $allow = array_keys($this->data);
+        }
+        $allow = array_diff($allow, $this->hidden);
         foreach ($this->data as $key => $val) {
-            // 如果是隐藏属性不输出
-            if (in_array($key, $this->hidden)) {
+            // 属性过滤输出
+            if (!in_array($key, $allow)) {
                 continue;
             }
 
@@ -509,12 +514,13 @@ abstract class Model implements \JsonSerializable, \ArrayAccess
     /**
      * 转换当前模型对象为JSON字符串
      * @access public
-     * @param integer $options json参数
+     * @param array     $allow 允许输出的属性列表
+     * @param integer   $options json参数
      * @return string
      */
-    public function toJson($options = JSON_UNESCAPED_UNICODE)
+    public function toJson($allow = [], $options = JSON_UNESCAPED_UNICODE)
     {
-        return json_encode($this->toArray(), $options);
+        return json_encode($this->toArray($allow), $options);
     }
 
     /**