mirrors/easyappointments
1
0
Fork 1
mirror of https://github.com/alextselegidis/easyappointments.git synced 2024-12-26 16:42:27 +03:00
Code Issues Projects Releases Packages Wiki Activity

Whitelist incoming account update request params (#1225)

Browse source
This commit is contained in:
Alex Tselegidis 2022-03-25 11:59:00 +01:00
parent 0452e9543d
commit b7833643c2
1 changed files with 28 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
application/controllers/Account.php
View file

@ -48,7 +48,7 @@ class Account extends EA_Controller {
session(['dest_url' => site_url('account')]);
$user_id = session('user_id');
if (cannot('view', PRIV_USER_SETTINGS))
{
if ($user_id)
@ -91,6 +91,32 @@ class Account extends EA_Controller {
$account = request('account');
$account['id'] = session('user_id');
$this->users_model->only($account, [
'id',
'first_name',
'last_name',
'email',
'mobile_number',
'phone_number',
'address',
'city',
'state',
'zip_code',
'notes',
'timezone',
'language',
'settings'
]);
$this->users_model->only($account['settings'], [
'username',
'password',
'notifications',
'calendar_view'
]);
$this->users_model->save($account);
session([
@ -140,7 +166,7 @@ class Account extends EA_Controller {
try
{
// Check if language exists in the available languages.
$found = FALSE;
foreach (config('available_languages') as $lang)