You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When we show a readonly Select2 field to the user profile, we add the disabled property to the <select> html element to prevent the user from changing the field's contents. The issue here is that when the form is submitted, the select2 field contents is not passed along with the form (since it is disabled), and so when PMProRH tries to save the data, it cannot find the field data and it instead empties the usermeta contents.
As a side-effect of how this works, if a user edits the source code of the profile page, they can then remove the disabled property and change the value of the readonly field. That change would actually save successfully.
Check out for a new non-admin user and fill in the select 2 field at checkout
Go to the user profile as the non-admin user and see that the select2 field shows the correct data
Save the profile and see that the data is then erased
Expected behavior
The profile save code should not run at all for readonly fields. Fix would also resolve the security issue I mentioned above with users being able to change readonly fields.
My suggestion to fix this issue is to wrap all of this code in an if ( ! empty( field->readonly ) ){ }:
Isolating the problem (mark completed items with an [x]):
I have deactivated other plugins and confirmed this bug occurs when only Paid Memberships Pro plugin is active.
This bug happens with a default WordPress theme active, or Memberlite.
I can reproduce this bug consistently using the steps above.
WordPress Environment
```
Please share non-sensitive information about your hosting environment such as WordPress version, PHP version, Paid Memberships Pro and any related plugins versions.
```
The text was updated successfully, but these errors were encountered:
Describe the bug
When we show a readonly Select2 field to the user profile, we add the
disabled
property to the<select>
html element to prevent the user from changing the field's contents. The issue here is that when the form is submitted, the select2 field contents is not passed along with the form (since it is disabled), and so when PMProRH tries to save the data, it cannot find the field data and it instead empties the usermeta contents.As a side-effect of how this works, if a user edits the source code of the profile page, they can then remove the
disabled
property and change the value of the readonly field. That change would actually save successfully.To Reproduce
Steps to reproduce the behavior:
Expected behavior
The profile save code should not run at all for readonly fields. Fix would also resolve the security issue I mentioned above with users being able to change readonly fields.
My suggestion to fix this issue is to wrap all of this code in an
if ( ! empty( field->readonly ) ){ }
:pmpro-register-helper/pmpro-register-helper.php
Lines 1118 to 1149 in e90c450
Isolating the problem (mark completed items with an [x]):
WordPress Environment
The text was updated successfully, but these errors were encountered: