IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

FIX: Don't allow username update via update route

Browse Source 
It's not using the UsernameChanger
This commit is contained in:
Robin Ward 2018-01-26 16:53:10 -05:00
parent 452a6bfa9c
commit 2d340d1122
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
app/controllers/users_controller.rb
View File

@ -107,6 +107,9 @@ class UsersController < ApplicationController
guardian.ensure_can_edit!(user)
attributes = user_params.merge!(custom_fields: params[:custom_fields])
# We can't update the username via this route. Use the username route
attributes.delete(:username)
if params[:user_fields].present?
attributes[:custom_fields] = {} unless params[:custom_fields].present?