[8.x] Enforce implicit Route Model scoping

src/Illuminate/Routing/ImplicitRouteBinding.php

@@ -41,7 +41,7 @@ public static function resolveForRoute($container, $route)
                         ? 'resolveSoftDeletableRouteBinding'
                         : 'resolveRouteBinding';
 
-            if ($parent instanceof UrlRoutable && in_array($parameterName, array_keys($route->bindingFields()))) {
+            if ($parent instanceof UrlRoutable && ($route->enforcesScoping() || array_key_exists($parameterName, $route->bindingFields()))) {
                 $childRouteBindingMethod = $route->allowsTrashedBindings()
                             ? 'resolveSoftDeletableChildRouteBinding'
                             : 'resolveChildRouteBinding';

src/Illuminate/Routing/Route.php

@@ -1077,6 +1077,16 @@ public function excludedMiddleware()
         return (array) ($this->action['excluded_middleware'] ?? []);
     }
 
+    /**
+     * Determine if the route should enforce scoping of multiple Eloquent bindings.
+     *
+     * @return bool
+     */
+    public function enforcesScoping()
+    {
+        return (bool) ($this->action['scoping'] ?? false);
+    }
+
     /**
      * Specify that the route should not allow concurrent requests from the same session.
      *

tests/Integration/Routing/ImplicitRouteBindingTest.php

@@ -50,8 +50,15 @@ protected function defineDatabaseMigrations(): void
             $table->softDeletes();
         });
 
+        Schema::create('posts', function (Blueprint $table) {
+            $table->increments('id');
+            $table->integer('user_id');
+            $table->timestamps();
+        });
+
         $this->beforeApplicationDestroyed(function () {
             Schema::dropIfExists('users');
+            Schema::dropIfExists('posts');
         });
     }
 
@@ -60,14 +67,14 @@ public function testWithRouteCachingEnabled()
         $this->defineCacheRoutes(<<<PHP
 <?php
 
-use Illuminate\Tests\Integration\Routing\ImplicitBindingModel;
+use Illuminate\Tests\Integration\Routing\ImplicitBindingUser;
 
-Route::post('/user/{user}', function (ImplicitBindingModel \$user) {
+Route::post('/user/{user}', function (ImplicitBindingUser \$user) {
     return \$user;
 })->middleware('web');
 PHP);
 
-        $user = ImplicitBindingModel::create(['name' => 'Dries']);
+        $user = ImplicitBindingUser::create(['name' => 'Dries']);
 
         $response = $this->postJson("/user/{$user->id}");
 
@@ -79,11 +86,11 @@ public function testWithRouteCachingEnabled()
 
     public function testWithoutRouteCachingEnabled()
     {
-        $user = ImplicitBindingModel::create(['name' => 'Dries']);
+        $user = ImplicitBindingUser::create(['name' => 'Dries']);
 
         config(['app.key' => str_repeat('a', 32)]);
 
-        Route::post('/user/{user}', function (ImplicitBindingModel $user) {
+        Route::post('/user/{user}', function (ImplicitBindingUser $user) {
             return $user;
         })->middleware(['web']);
 
@@ -97,13 +104,13 @@ public function testWithoutRouteCachingEnabled()
 
     public function testSoftDeletedModelsAreNotRetrieved()
     {
-        $user = ImplicitBindingModel::create(['name' => 'Dries']);
+        $user = ImplicitBindingUser::create(['name' => 'Dries']);
 
         $user->delete();
 
         config(['app.key' => str_repeat('a', 32)]);
 
-        Route::post('/user/{user}', function (ImplicitBindingModel $user) {
+        Route::post('/user/{user}', function (ImplicitBindingUser $user) {
             return $user;
         })->middleware(['web']);
 
@@ -114,13 +121,13 @@ public function testSoftDeletedModelsAreNotRetrieved()
 
     public function testSoftDeletedModelsCanBeRetrievedUsingWithTrashedMethod()
     {
-        $user = ImplicitBindingModel::create(['name' => 'Dries']);
+        $user = ImplicitBindingUser::create(['name' => 'Dries']);
 
         $user->delete();
 
         config(['app.key' => str_repeat('a', 32)]);
 
-        Route::post('/user/{user}', function (ImplicitBindingModel $user) {
+        Route::post('/user/{user}', function (ImplicitBindingUser $user) {
             return $user;
         })->middleware(['web'])->withTrashed();
 
@@ -131,13 +138,96 @@ public function testSoftDeletedModelsCanBeRetrievedUsingWithTrashedMethod()
             'name' => $user->name,
         ]);
     }
+
+    public function testEnforceScopingImplicitRouteBindings()
+    {
+        $user = ImplicitBindingUser::create(['name' => 'Dries']);
+        $post = ImplicitBindingPost::create(['user_id' => 2]);
+        $this->assertEmpty($user->posts);
+
+        config(['app.key' => str_repeat('a', 32)]);
+
+        Route::group(['scoping' => true], function () {
+            Route::get('/user/{user}/post/{post}', function (ImplicitBindingUser $user, ImplicitBindingPost $post) {
+                return [$user, $post];
+            })->middleware(['web']);
+        });
+
+        $response = $this->getJson("/user/{$user->id}/post/{$post->id}");
+
+        $response->assertNotFound();
+    }
+
+    public function testEnforceScopingImplicitRouteBindingsWithRouteCachingEnabled()
+    {
+        $user = ImplicitBindingUser::create(['name' => 'Dries']);
+        $post = ImplicitBindingPost::create(['user_id' => 2]);
+        $this->assertEmpty($user->posts);
+
+        $this->defineCacheRoutes(<<<PHP
+<?php
+
+use Illuminate\Tests\Integration\Routing\ImplicitBindingUser;
+use Illuminate\Tests\Integration\Routing\ImplicitBindingPost;
+
+Route::group(['scoping' => true], function () {
+    Route::get('/user/{user}/post/{post}', function (ImplicitBindingUser \$user, ImplicitBindingPost \$post) {
+        return [\$user, \$post];
+    })->middleware(['web']);
+});
+PHP);
+
+        $response = $this->getJson("/user/{$user->id}/post/{$post->id}");
+
+        $response->assertNotFound();
+    }
+
+    public function testWithoutEnforceScopingImplicitRouteBindings()
+    {
+        $user = ImplicitBindingUser::create(['name' => 'Dries']);
+        $post = ImplicitBindingPost::create(['user_id' => 2]);
+        $this->assertEmpty($user->posts);
+
+        config(['app.key' => str_repeat('a', 32)]);
+
+        Route::group(['scoping' => false], function () {
+            Route::get('/user/{user}/post/{post}', function (ImplicitBindingUser $user, ImplicitBindingPost $post) {
+                return [$user, $post];
+            })->middleware(['web']);
+        });
+
+        $response = $this->getJson("/user/{$user->id}/post/{$post->id}");
+        $response->assertOk();
+        $response->assertJson([
+            [
+                'id' => $user->id,
+                'name' => $user->name,
+            ],
+            [
+                'id' => 1,
+                'user_id' => 2,
+            ],
+        ]);
+    }
 }
 
-class ImplicitBindingModel extends Model
+class ImplicitBindingUser extends Model
 {
     use SoftDeletes;
 
     public $table = 'users';
 
     protected $fillable = ['name'];
+
+    public function posts()
+    {
+        return $this->hasMany(ImplicitBindingPost::class, 'user_id');
+    }
+}
+
+class ImplicitBindingPost extends Model
+{
+    public $table = 'posts';
+
+    protected $fillable = ['user_id'];
 }