Fix Business Logic Errors in CakePHP

public function checkout() {
    $order = $this->Orders->newEmptyEntity();
    if ($this->request->is('post')) {
        // VULNERABILITY: Mass assignment allows the attacker to inject 'total_price' or 'discount_code'
        // directly into the request body, bypassing server-side calculation logic.
        $order = $this->Orders->patchEntity($order, $this->request->getData());
    // The attacker sends: {'product_id': 1, 'quantity': 1, 'total_price': 0.01}
    if ($this->Orders->save($order)) {
        $this->Flash->success(__('Order placed.'));
    }
}
}

public function checkout() {
    $order = $this->Orders->newEmptyEntity();
    if ($this->request->is('post')) {
        $data = $this->request->getData();
    // 1. Fetch immutable data from the DB, not the request
    $product = $this->Orders->Products->get($data['product_id']);
    
    // 2. Use 'accessibleFields' to whitelist only non-sensitive inputs
    $order = $this->Orders->patchEntity($order, $data, [
        'accessibleFields' => ['product_id' => true, 'quantity' => true, 'total_price' => false]
    ]);

    // 3. Enforce server-side logic for sensitive values
    $order->unit_price = $product->price;
    $order->total_price = $product->price * $order->quantity;

    if ($order->quantity <= 0) {
        throw new BadRequestException('Invalid quantity.');
    }

    if ($this->Orders->save($order)) {
        $this->Flash->success(__('Order secure.'));
    }
}
}