[#31698] - [4.0] Add User ID validation to fields
- Fixed in Code Base
- 13 Jan 2021
- Medium
- Build: 4.0-dev
- # 31698
- Diff
- wilsonge:feature/user-id-validation
User tests: Successful: Unsuccessful:
Pull Request for Issue #30969 .
Summary of Changes
Adds a new validation rule for having a valid user ID and applies it to all form fields in the CMS of type user.
Testing Instructions
Joomla 4 -> Edit any article (sample data or manually create one and hit save)
Edit HTML of the edit page with inspector tools
change the value of jform_created_by_id field
Before patch: If you hit save you'll get a database validation error Save failed with the following error: Incorrect integer value: 'Mr Hacker' for column 'created_by' at row 1 (see original issue for screenshot). After patch:
You can also try and do the same thing with an invalid user id (e.g. 999999) - note before patch an integer id even if not valid was saved to the DB. After the patch it will not be.
Backwards Compatibility
There is one issue here which is that articles which were created by deleted users now will NOT save to the database until they are changed to point to a user that does exist. I'm unsure how serious to rank this as an issue (you will get an error like the following :-
but it will still save)
Documentation Changes Required
Possibly relating to the deleted users comment.
/cc @joomla/security
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_banners com_categories com_contact com_content com_fields com_finder com_newsfeeds com_tags com_users Front End Libraries Plugins |
| Labels |
Added:
?
|
||
| Title |
|
||||||
I have tested this item
I can confirm:
before the patch an in valid user ID is saved - two messages: Article Saved (success) and Unable to find user with the ID: 800 (warning).
with the patch an invalid user ID is not saved - two messages combined as one warning: Invalid field: Created By and Unable to find user with the ID: 800.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/31698.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/31698.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/31698.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-01-13 18:17:21 |
| Closed_By | ⇒ | richard67 | |
| Labels |
Added:
?
|
||
Thanks!
OK I pushed up the actual working version to the wrong remote last night? Some of this fixes your comments @Denitz (like the required field properties and the value returned).