Filter variables when updating user profile

1 files changed, 8 insertions, 3 deletions

diff --git a/app/Controller/UserModificationController.php b/app/Controller/UserModificationController.php
index ed145921..f4916f6f 100644
--- a/app/Controller/UserModificationController.php
+++ b/app/Controller/UserModificationController.php
@@ -47,9 +47,14 @@ class UserModificationController extends BaseController
         $values = $this->request->getValues();
 
         if (! $this->userSession->isAdmin()) {
-            if (isset($values['role'])) {
-                unset($values['role']);
-            }
+            $values = array(
+                'id' => $this->userSession->getId(),
+                'username' => isset($values['username']) ? $values['username'] : '',
+                'name' => isset($values['name']) ? $values['name'] : '',
+                'email' => isset($values['email']) ? $values['email'] : '',
+                'timezone' => isset($values['timezone']) ? $values['timezone'] : '',
+                'language' => isset($values['language']) ? $values['language'] : '',
+            );
         }
 
         list($valid, $errors) = $this->userValidator->validateModification($values);