github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 22:43:33 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Don't allow username update via update route

Browse Source 
It's not using the UsernameChanger
This commit is contained in:
Robin Ward
2018-01-26 16:53:10 -05:00
parent 452a6bfa9c
commit 2d340d1122
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/controllers/users_controller.rb
View File

@ -107,6 +107,9 @@ class UsersController < ApplicationController
guardian.ensure_can_edit!(user) guardian.ensure_can_edit!(user)
attributes = user_params.merge!(custom_fields: params[:custom_fields]) attributes = user_params.merge!(custom_fields: params[:custom_fields])
# We can't update the username via this route. Use the username route
attributes.delete(:username)
if params[:user_fields].present? if params[:user_fields].present?
attributes[:custom_fields] = {} unless params[:custom_fields].present? attributes[:custom_fields] = {} unless params[:custom_fields].present?