BlogCommentのaccessibleを指定

plugins/bc-blog/src/Model/Entity/BlogComment.php

@@ -40,8 +40,15 @@ class BlogComment extends Entity
      * @var array
      */
     protected array $_accessible = [
-        '*' => true,
-        'id' => false
+        '*' => false,
+        'blog_content_id' => true,
+        'blog_post_id' => true,
+        'no' => true,
+        'status' => true,
+        'name' => true,
+        'email' => true,
+        'url' => true,
+        'message' => true
     ];
 
 }

plugins/bc-blog/tests/TestCase/Service/BlogCommentsServiceTest.php

@@ -330,6 +330,39 @@ public function testAdd()
         $this->BlogCommentsService->add(1, 1, []);
     }
 
+    /**
+     * test add
+     * 関連テーブルのデータを送っても、ブログ記事は作成・更新されない
+     */
+    public function testAddIgnoresAssociatedData()
+    {
+        $this->loadFixtureScenario(
+            BlogContentScenario::class,
+            1,  // id
+            1, // siteId
+            null, // parentId
+            'news1', // name
+            '/news/' // url
+        );
+        BlogPostFactory::make(['id' => 1, 'blog_content_id' => 1, 'status' => true])->persist();
+        $data = [
+            'name' => 'baserCMS',
+            'message' => 'test',
+            'blog_post' => [
+                'blog_content_id' => 1,
+                'title' => 'injected',
+                'user_id' => 1,
+                'status' => true,
+                'posted' => '2024-01-01 00:00:00',
+            ],
+        ];
+        $result = $this->BlogCommentsService->add(1, 1, $data);
+
+        $this->assertEquals(1, $result->blog_post_id);
+        $this->assertEquals(1, BlogPostFactory::count());
+        $this->assertNotEquals('injected', BlogPostFactory::get(1)->title);
+    }
+
     /**
      * test sendCommentToAdmin
      */