Merge pull request #501 from kenjis/improve-RegisterController-allowe…

…dPostFields fix: set only validated fields to User Entity in RegisterController
codeigniter4 · Nov 5, 2022 · 7e90fda · 7e90fda
2 parents fc01d3a + 33cc6d3
commit 7e90fda
Showing 1 changed file with 2 additions and 6 deletions.
diff --git a/src/Controllers/RegisterController.php b/src/Controllers/RegisterController.php
@@ -76,12 +76,8 @@ public function registerAction(): RedirectResponse
         }
 
         // Save the user
-        $allowedPostFields = array_merge(
-            setting('Auth.validFields'),
-            setting('Auth.personalFields'),
-            array_keys($rules),
-        );
-        $user = $this->getUserEntity();
+        $allowedPostFields = array_keys($rules);
+        $user              = $this->getUserEntity();
         $user->fill($this->request->getPost($allowedPostFields));
 
         // Workaround for email only registration/login