Quote from: Oleg at Feb 14, 2011, 04:06 AM
But doesn’t that still allow people to modify it by modifying the HTML of the page before they submit the form?
The issue is that the UpdateProfile field accepts all POST parameters passed with the form, whether or not they were in the original form.
Yes, modifying UpdateProfile would be a better choice.
I think this would do it:
In the UpdateProfile snippet, change:
<?php
foreach ($fields as $k => $v) {
$fields[$k] = str_replace(array('[',']'),array('[',']'),$v);
}
to something like this:
<?php
if (!empty($login->config['readOnly'])) {
$ignore = explode(',', $login->config['readOnly']);
foreach ($fields as $k => $v) {
if (in_array($k, $ignore) {
unset $fields[$k];
}
}
}
foreach ($fields as $k => $v) {
$fields[$k] = str_replace(array('[',']'),array('[',']'),$v);
}
Combined with readonly="readonly" in the Tpl chunk, and a &readOnly parameter with a comma-separated list of restricted fields, that should protect the fields.
If you get that working, you could submit it as a pull request for the Login package.
☆ A M B ☆
.
