What causes "cms::lang.cms_object.invalid_property" in octobercms/october?

Filter input before filling: `array_intersect_key($data, array_flip(['fileName', 'content']))`.

octobercms/october · error · ApplicationException

cms::lang.cms_object.invalid_property

Error message

cms::lang.cms_object.invalid_property

What it means

ApplicationException thrown by `Lang::fill(array $attributes)` when a key being mass-assigned is not in the model's `$fillable` list (for theme lang files: `fileName` and `content`). This is a strict mass-assignment whitelist: any extra key aborts the whole fill instead of being ignored.

Source

Thrown at modules/cms/classes/Lang.php:237

        $this->fileName = $fileName;
        $this->originalFileName = $fileName;
        $this->mtime = File::lastModified($filePath);
        $this->content = $content;
        $this->exists = true;

        return $this;
    }

    /**
     * Sets the object attributes.
     * @param array $attributes A list of attributes to set.
     */
    public function fill(array $attributes)
    {
        foreach ($attributes as $key => $value) {
            if (!in_array($key, $this->fillable)) {
                throw new ApplicationException(LangHelper::get(
                    'cms::lang.cms_object.invalid_property',
                    ['name' => $key]
                ));
            }

            $this->$key = $value;
        }
    }

    /**
     * save the object to the disk
     */
    public function save(array $options = [])
    {
        $this->validateFileName();

        $fullPath = $this->getFilePath();

View on GitHub (pinned to b608633a7e)

Solutions

Filter input before filling: `array_intersect_key($data, array_flip(['fileName', 'content']))`.
Remove extra keys (unset) from the attributes array your code builds before calling fill().
If you truly need more assignable attributes, subclass the Lang class and extend its `$fillable`.

Example fix

// before
$lang->fill($request->all()); // request also carries 'id', 'title', ...

// after
$lang->fill(array_intersect_key($request->all(), array_flip(['fileName', 'content'])));

Defensive patterns

Strategy: validation

Validate before calling

$allowedKeys = array_flip(['fileName', 'content']);
$safe = array_intersect_key($request->all(), $allowedKeys);
// keys outside the whitelist are dropped, never filled
$lang->fill($safe);

Try / catch

try {
    $lang->fill($attributes);
} catch (Cms\Classes\CmsObjectException $e) { // ApplicationException
    // report which key was rejected so the caller can fix its payload
    Log::info('Rejected mass-assignment', ['keys' => array_keys($attributes)]);
    throw $e;
}

Prevention

Never forward $request->all() into fill(); always intersect with the model's fillable list.
Use $model->getFillable() when building the filter so it stays in sync with the model.
Prefer explicit property assignment for the two known fields in small scripts.

When it happens

Trigger: Calling `fill($request->all())` on a Lang object when the request contains extra fields (e.g. 'title', 'locale', 'id'); a plugin or seed script passing an options array with keys the Lang class does not define.

Common situations: Forwarding unfiltered HTTP request data into the CMS object model; migrating code from a version that tolerated extra keys; third-party plugins extending lang-file forms with additional POST fields that then hit fill().

Related errors

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/fca3a282ec725a44. Report an issue: GitHub.