This is a follow up on #710682: Allow re-loading object on entity_metadata_wrapper()
If a user object is passed to entity_metadata_wrapper() we make sure to re-load it. I think this can also help solving security issues, if a user is passing the global $user, instead of cloning it and passing an $account

CommentFileSizeAuthor
#3 1375788-load-user-metadata-3.patch844 bytesamitaibu
entity-load-user.patch761 bytesamitaibu
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Status: Needs review » Needs work

The last submitted patch, entity-load-user.patch, failed testing.

fago’s picture

fago
Primary language German
Location Vienna
CreditAttribution: fago commented

Sounds good. As test fails show, we need to check whether the uid property is set though. Maybe even better, only do that if the passed entity matches $GLOBALS['user'].

amitaibu’s picture

amitaibu
Primary language Hebrew
Location Israel
CreditAttribution: amitaibu commented
Status: Needs work » Needs review
FileSize
1375788-load-user-metadata-3.patch844 bytes

Ok, let's try this one..

fago’s picture

fago
Primary language German
Location Vienna
CreditAttribution: fago commented
Status: Needs review » Fixed

thanks. I've changed it to use $GLOBALS['user'] to save a line, improved the comment a bit and committed it.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.