0003479: Reset account preferences of an user results in reset administrators account

ID	Project	Category	View Status	Date Submitted	Last Update
0003479	mantisbt	bugtracker	public	2003-12-27 22:01	2004-02-06 16:16

Reporter	steffi	Assigned To	vboctor
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	fixed
OS	Windows XP
Product Version	0.18.0

Summary	0003479: Reset account preferences of an user results in reset administrators account
Description	I tried to reset account preferences of an user by clicking on the button 'Reset Prefs'. But it resets my own account preferences! I've found out, that the page account_prefs_reset calls the function: user_pref_set_default( auth_get_current_user_id() ). As you see, it doesn't submit the user_id but the current user_id.
Tags	No tags attached.
Attached Files	3479_fix_reset_preferences.diff (918 bytes) Index: account_prefs_reset.php =================================================================== RCS file: /cvsroot/mantisbt/mantisbt/account_prefs_reset.php,v retrieving revision 1.23 diff -u -r1.23 account_prefs_reset.php --- account_prefs_reset.php 15 Feb 2003 10:25:15 -0000 1.23 +++ account_prefs_reset.php 3 Jan 2004 04:08:33 -0000 @@ -31,15 +31,15 @@ require_once( $t_core_path.'user_pref_api.php' ); #============ Parameters ============ + $f_user_id = gpc_get_int( 'user_id' ); $f_redirect_url = gpc_get_string( 'redirect_url', 'account_prefs_page.php' ); #============ Permissions ============ auth_ensure_user_authenticated(); - current_user_ensure_unprotected(); -?> -<?php - user_pref_set_default( auth_get_current_user_id() ); + user_ensure_unprotected( $f_user_id ); + + user_pref_set_default( $f_user_id ); print_header_redirect( $f_redirect_url ); ?> 3479_fix_reset_preferences.diff (918 bytes)

View Issue Details

Activities

vboctor 2004-01-03 05:15 manager ~0004847	There was actually two issues: Ensuring that the user account is not protected was done for the current account (rather than the one being modified). Resetting of preferences was done on the current account (rather than the one being modified). Both are now fixed in CVS, and a patch is attached to the bug. Thanks.