diff options
| author | Neil Drumm <drumm@3064.no-reply.drupal.org> | 2006-11-16 09:01:55 +0000 |
|---|---|---|
| committer | Neil Drumm <drumm@3064.no-reply.drupal.org> | 2006-11-16 09:01:55 +0000 |
| commit | c8a996a2ee67bbdff47543dd65a9159ce7c1021c (patch) | |
| tree | 057117a086d582944173781292840a2c851bb6a4 | |
| parent | 1d95dcbf28c90e9f6f0bf9618d913b8a9a70c7e4 (diff) | |
| download | brdo-c8a996a2ee67bbdff47543dd65a9159ce7c1021c.tar.gz brdo-c8a996a2ee67bbdff47543dd65a9159ce7c1021c.tar.bz2 | |
#79804 by pwolanin. Junk keeps falling in $user->data.
| -rw-r--r-- | modules/user/user.module | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/modules/user/user.module b/modules/user/user.module index 4ee3ae7ae..1589e747d 100644 --- a/modules/user/user.module +++ b/modules/user/user.module @@ -1223,6 +1223,8 @@ function user_register_submit($form_id, $form_values) { watchdog('security', t('Detected malicious attempt to alter protected user fields.'), WATCHDOG_WARNING); return 'user/register'; } + //the unset below is needed to prevent these form values from being saved as user data + unset($form_values['form_token'], $form_values['submit'], $form_values['op'], $form_values['notify'], $form_values['form_id'], $form_values['affiliates'], $form_values['destination']); $account = user_save('', array_merge($form_values, array('pass' => $pass, 'init' => $mail, 'roles' => $roles, 'status' => ($admin || variable_get('user_register', 1) == 1)))); watchdog('user', t('New user: %name %email.', array('%name' => $name, '%email' => '<'. $mail .'>')), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $account->uid .'/edit')); @@ -1466,7 +1468,7 @@ function user_edit_validate($form_id, $form_values) { function user_edit_submit($form_id, $form_values) { $account = $form_values['_account']; $category = $form_values['_category']; - unset($form_values['_account'], $form_values['submit'], $form_values['delete'], $form_values['form_id'], $form_values['_category']); + unset($form_values['_account'], $form_values['op'], $form_values['submit'], $form_values['delete'], $form_values['form_token'], $form_values['form_id'], $form_values['_category']); user_module_invoke('submit', $form_values, $account, $category); user_save($account, $form_values, $category); // Delete that user's menu cache. |