mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-01-16 20:28:28 +01:00
Code Issues Releases Wiki Activity

More user-setting checks.

Browse Source
This commit is contained in:
Cameron 2016-06-28 09:25:30 -07:00
parent b82cfaea92
commit 0af67301ea
2 changed files with 33 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
e107_handlers/user_handler.php
View File

@ -54,7 +54,7 @@ class UserHandler
var $preferred = PASSWORD_DEFAULT_TYPE; // Preferred password format
var $passwordOpts = 0; // Copy of pref
var $passwordEmail = false; // True if can use email address to log in
var $otherFields = array();
private $otherFields = array();
private $passwordAPI = false;
// Constructor
@ -179,6 +179,36 @@ class UserHandler
}
/**
* Check if a user posted field is readonly (should not be user-editable) - used in usersettings.php
* @param array $posted
* @return bool
*/
public function hasReadonlyField($posted)
{
$restricted = array_keys($this->otherFields);
$pref = e107::getPref();
if(empty($pref['signup_option_class']))
{
$restricted[] = 'user_class';
}
foreach($posted as $k=>$v)
{
if(in_array($k,$restricted))
{
return true;
}
}
return false;
}
/**
* Given plaintext password and login name, generate password string to store in DB
*

4
usersettings.php
View File

@ -352,8 +352,9 @@ elseif (isset($_POST['SaveValidatedInfo'])) // Next bit only valid if user editi
{ // Got some data confirmed with password entry
$new_data = base64_decode($_POST['updated_data']);
// Should only happen if someone's fooling around
if (md5($new_data) != $_POST['updated_key'] || isset($new_data['user_admin']) || isset($new_data['user_perms']))
if (md5($new_data) != $_POST['updated_key'] || ($userMethods->hasReadonlyField($new_data) !==false))
{
echo LAN_USET_42.'<br />';
exit();
@ -812,7 +813,6 @@ function req($field)
}
// Delete a file from the public directories. Return TRUE on success, FALSE on failure.
// Also deletes from database if appropriate.
function delete_file($fname, $dir = 'avatars/')