Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-9890

Custom profile field data not checked sufficiently before insert into phpbb_profile_fields_data inside functions_user.php

    XMLWordPrintable

Details

    Description

      If you create a custom profile field and do not make it a required field, you'll get an sql error when a user creates a new account but leaves the field blank. It will actually work the first time, it's every user after that will fail because a blank entry is inserted into phpbb_profile_fields_data the first time, then the insert fails for all subsequent times as an attempt to insert duplicate data. A "General Error" message appears to the user and the user account is created but not assigned to any user groups so they cannot view any forums.

      I fixed it in my copy by checking if there was any actual data for the field in functions_user.php after the comment at line 254 .

      if ($cp_data !== false && sizeof($cp_data))

      Instead, I iterate through any fields defined in $cp_data and see if there is actually data entered for any field before performing the insert into PROFILE_FIELDS_DATA_TABLE

      Maybe there is a more elegant solution but it worked for me.

      Attachments

        Activity

          People

            nickvergessen Joas Schilling
            nbdexter nbdexter [X] (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: