This is a follow up on #710682: Allow re-loading object on entity_metadata_wrapper()
If a user object is passed to entity_metadata_wrapper() we make sure to re-load it. I think this can also help solving security issues, if a user is passing the global $user, instead of cloning it and passing an $account

CommentFileSizeAuthor
#3 1375788-load-user-metadata-3.patch844 bytesamitaibu
entity-load-user.patch761 bytesamitaibu

Comments

Status: Needs review » Needs work

The last submitted patch, entity-load-user.patch, failed testing.

fago’s picture

fago
Primary language German
Location Vienna
commented

Sounds good. As test fails show, we need to check whether the uid property is set though. Maybe even better, only do that if the passed entity matches $GLOBALS['user'].

amitaibu’s picture

amitaibu
Primary language Hebrew
Location Israel
commented
Status: Needs work » Needs review
StatusFileSize
new 1375788-load-user-metadata-3.patch844 bytes

Ok, let's try this one..

fago’s picture

fago
Primary language German
Location Vienna
commented
Status: Needs review » Fixed

thanks. I've changed it to use $GLOBALS['user'] to save a line, improved the comment a bit and committed it.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.