From d0c588acf1a94803a7cec7dd877cf316ca6451f9 Mon Sep 17 00:00:00 2001
From: sokollondon <s100790@yandex.ru>
Date: Wed, 10 Feb 2021 14:59:26 +0500
Subject: [PATCH] =?UTF-8?q?Enh:=20=D0=90djust=20access=20to=20save=20the?=
 =?UTF-8?q?=20relation=20#66=20checkRelationsSafe?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/SaveRelationsBehavior.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/SaveRelationsBehavior.php b/src/SaveRelationsBehavior.php
index 88adca3..7c3dc3e 100644
--- a/src/SaveRelationsBehavior.php
+++ b/src/SaveRelationsBehavior.php
@@ -31,6 +31,12 @@ class SaveRelationsBehavior extends Behavior
 
     public $relations = [];
     public $relationKeyName = self::RELATION_KEY_FORM_NAME;
+    /**
+     * Save only safe relation. Check as attribute.
+     * @see https://www.yiiframework.com/doc/guide/2.0/en/input-validation
+     * @var bool
+     */
+    public $checkRelationsSafe = false;
 
     private $_relations = [];
     private $_oldRelationValue = []; // Store initial relations value
@@ -729,6 +735,7 @@ public function loadRelations($data)
         /** @var BaseActiveRecord $owner */
         $owner = $this->owner;
         foreach ($this->_relations as $relationName) {
+            if($this->checkRelationsSafe && !$owner->isAttributeSafe($relationName)) continue;
             $keyName = $this->_getRelationKeyName($relationName);
             if (array_key_exists($keyName, $data)) {
                 $owner->{$relationName} = $data[$keyName];