Question

I want to store merchant data in a remote database so it is PCI compliant. The idea is that I configure my web app with the ability to store the merchant information on the remote database but only have the ability to read certain fields. So the web app can insert an encrypted card number for example, but does not have read rights to pull it back.

However, when I create paginated queries, of course the model will attempt to include the INSERT/UPDATE only account number field in the SELECT query causing an error.

Is there a way to tell the model in CakePHP to ignore certain fields that do not have read rights without ignoring it for inserts / updates? Or will I have to hand spin all of my queries with the included joins?

Answer 1

After some thought, I realized the obvious. I just need to tell the pagination which fields I want to pull, leaving the account out. I just add it to the top of the controller.

public $paginate = array(
        'fields' => array(
            'UserCard.id', 
            'UserCard.name',
            'UserCard.user_id',
            'UserCard.status', 
            'UserCard.financial_institution_id',
        ),
    );

Do you ever try to make things more difficult than they are? Doh!