Filter attributes when strict: true

lib/dao.js

@@ -2297,6 +2297,7 @@ DataAccessObject.prototype.updateAttributes = function updateAttributes(data, op
   assert(typeof connector.updateAttributes === 'function',
     'updateAttributes() must be implemented by the connector');
 
+  var strict = this.__strict;
   var model = Model.modelName;
   var hookState = {};
 
@@ -2334,6 +2335,12 @@ DataAccessObject.prototype.updateAttributes = function updateAttributes(data, op
     if (err) return cb(err);
     data = ctx.data;
 
+    if (strict) {
+      var keys = Object.keys(Model.definition.properties);
+      data = utils.selectFields(keys)(data);
+      data = removeUndefined(data);
+    }
+
     // update instance's properties
     inst.setAttributes(data);
 

test/manipulation.test.js

@@ -19,7 +19,7 @@ describe('manipulation', function () {
       age: {type: Number, index: true},
       dob: Date,
       createdAt: {type: Date, default: Date}
-    }, { forceId: true });
+    }, { forceId: true, strict: true });
 
     db.automigrate(done);
 
@@ -490,6 +490,19 @@ describe('manipulation', function () {
           });
         });
     });
+    
+    it('should ignore unknown attributes', function(done) {
+      person.updateAttributes({foo:'bar'},
+        function(err, p) {
+          if (err) return done(err);
+          should.not.exist(p.foo);
+          Person.findById(p.id, function(e, p) {
+            if (e) return done(e);
+            should.not.exist(p.foo);
+            done();
+          });
+        });
+    });
 
     it('should allow same id value on updateAttributes', function(done) {
       person.updateAttributes({id: person.id, name: 'John'},
@@ -532,7 +545,7 @@ describe('manipulation', function () {
         });
     });
 
-    it('should allows model instance on updateAttributes', function(done) {
+    it('should allow model instance on updateAttributes', function(done) {
       person.updateAttributes(new Person({'name': 'John', age: undefined}),
         function(err, p) {
           if (err) return done(err);
@@ -545,7 +558,7 @@ describe('manipulation', function () {
         });
     });
 
-    it('should allows model instance on updateAttributes (promise variant)', function(done) {
+    it('should allow model instance on updateAttributes (promise variant)', function(done) {
       person.updateAttributes(new Person({'name': 'Jane', age: undefined}))
         .then(function(p) {
           return Person.findById(p.id)