When updating a user account e-mail address or password, we have to pass along the current password. For example, doing a PUT to ?q=[my-endpoint]/user/123.json with the following data...
{ uid: 123, name: 'Bob', mail: 'bob@hotmail.com', current_pass: 'my_current_secret', pass: 'my_new_secret' }
...results in the current_pass value being present (plain text) in the account JSON object result. Here's a simple patch that removes it.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | unset_current_pass-2472757-1.patch | 455 bytes | tyler.frankenstein |
Comments
Comment #1
tyler.frankenstein commentedComment #2
marcingy commentedLooks good and makes sense
Comment #3
kylebrowning commentedComment #5
jeni_dc commentedMoving this back to RTBC since it looks like this was never committed. I've just tested the patch against 7.x-3.16 since that release looks to be after the latest dev (?) and it's working fine here.
Comment #7
tyler.frankenstein commentedThanks for pointing this out, I'm not sure what happened here. But I've committed the fix just now.