☆ A M B ☆
My username is :[+user.username+]
On a separate note: This is not very likely to happen, but what if you didn’t want to offer the "Delete" profile functionality? Well, I assume leveraging a custom template and removing the "service=deleteprofile" button would be the first step, but what if someone happened to know about the functionality and manually passed in "?service=deleteprofile" ...By having WLPE installed, does this automatically give users this ability, regardless?Good point.
☆ A M B ☆
Good point.
I should probably change all the "profile" services to switch on $_POST[’service’] instead of $_REQUEST[’service’], then maybe specify that $_GET[’service’] = NULL; so that stuff could not be passed in the url.
[!WebLoginPE? &disableDeleteProfile=`1`!]
☆ A M B ☆
<div id="wlpeUser">
<form enctype="multipart/form-data" id="wlpeUserProfileForm" action="[~[*id*]~]" method="POST">
<fieldset id="wlpeUserProfileInput">
<div id="wlpeUserInfo">
<h3 id="wlpeProfileWelcome">Hello [+user.fullname+] ([+user.username+])!</h3>
<p id="wlpeProfileInfo" class="info">Use this form to update your profile information</p>
</div>
<legend>Your User Profile</legend>
<label for="wlpeUserProfileEmail">Email
<input id="wlpeUserProfileEmail" type="text" name="email" value="[+user.email+]" />
</label>
<fieldset id="wlpeNewPasswordArea">
<legend id="wlpeNewPasswordAreaLegend">Change your password</legend>
<p id="wlpeNewPasswordInfo">Change your password
<span class="info">(leave blank if you do not want a new password).</span></p>
<label for="wlpeUserProfilePassword">New Password
<input id="wlpeUserProfilePassword" type="password" name="password" value="" />
</label>
<label for="wlpeUserProfilePasswordConfirm">New Password (confirm)
<input id="wlpeUserProfilePasswordConfirm" type="password" name="password.confirm" value="" />
</label>
</fieldset>
</fieldset>
<fieldset id="wlpeUserProfileButtons">
<button type="submit" id="wlpeSaveProfileButton" name="service" value="saveprofile">Save</button>
<button type="submit" id="wlpeProfileDoneButton" name="service" value="cancel">Done</button>
<button type="submit" id="wlpeProfileLogoutButton" name="service" value="logout">Logout</button>
</fieldset>
</form>
</div>
Oops, putting the messages in a placeholder was a last minute change. I forgot to update the example forms.
I tried passing a custom profileTpl chunk that ONLY allows for password/email updates by the user:
Only when I try changing either the password or the email address, nothing happens
Also, [+wlpe.message+] is included in the default profileTpl, but not in the example shown in: assets/snippets/webloginpe/Default Forms/defaultProfileTpl.html.txt
I was confused as to why I wasn’t seeing the update message after any of my actions...
), does it save as expected? Maybe see what has to be taken away before it stops working?
☆ A M B ☆
☆ A M B ☆
I could not upload your photo. Please check the permissions of the "userimages" folder.
A crafty user, as you say, could also pass the url http://yoursite.url/profile.html?disableDeleteProfile=1&service=deleteprofile.
Quote from: Dr. at Sep 04, 2007, 10:28 AM
Good point.
I should probably change all the "profile" services to switch on $_POST[’service’] instead of $_REQUEST[’service’], then maybe specify that $_GET[’service’] = NULL; so that stuff could not be passed in the url.
I like your direction. Unfortunately, the approach wouldn’t be 100% preventable. A crafty user could easily create a simple <form> block, passing ’deleteprofile’ via the service parameter and would still technically be able to delete their own profile...don’t get me wrong, I may be taking this too far, but I can see some sites where "profile deletion" would NOT be desired by any means.
Maybe you could create an "enable_xxxx" (e.g. enable_deleteprofile) parameter, and setting it to 0 (zero) would protect profile deletion in cases such as those...
Or, disableDeleteProfile, so toggling "Off" is based on WLPE’s default behavior where deleting is enabled.
e.g.
[!WebLoginPE? &disableDeleteProfile=`1`!]
☆ A M B ☆
A crafty user, as you say, could also pass the url http://yoursite.url/profile.html?disableDeleteProfile=1&service=deleteprofile