When updating a user account e-mail address or password, we have to pass along the current password. For example, doing a PUT to ?q=[my-endpoint]/user/123.json with the following data...

{ uid: 123, name: 'Bob', mail: 'bob@hotmail.com', current_pass: 'my_current_secret', pass: 'my_new_secret' }

...results in the current_pass value being present (plain text) in the account JSON object result. Here's a simple patch that removes it.

Comments

tyler.frankenstein’s picture

Status: Active » Needs review
StatusFileSize
new455 bytes
marcingy’s picture

Status: Needs review » Reviewed & tested by the community

Looks good and makes sense

kylebrowning’s picture

Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

jeni_dc’s picture

Status: Closed (fixed) » Reviewed & tested by the community

Moving this back to RTBC since it looks like this was never committed. I've just tested the patch against 7.x-3.16 since that release looks to be after the latest dev (?) and it's working fine here.

tyler.frankenstein’s picture

Status: Reviewed & tested by the community » Fixed

Thanks for pointing this out, I'm not sure what happened here. But I've committed the fix just now.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.