修改OctoberCMS Laravel插件以禁用表单用户名更改

问题描述

我根据

虽然有人可以在

中添加用户名浏览器只需通过检查元素，编辑HTML：

 < div class =form-group> 
< label for =accountUsername>用户名< / label> 
< input name =usernametype =textid =accountUsernamevalue =Desired Username> 
< / div> 
  

提交并更改名称并更新用户名

解决方案

您可以用如下方式扩展User模型：

  \RainLab\User\Models\User :: extend（function（$ model）{
 
 $ model - > bindEvent（'model.beforeUpdate'，function（）use（$ model）{
 
 if（$ model-> isDirty（'username'））{
 
 throw new \ValidationException（['username'=>'抱歉！...']）; 
 
} 
 
}）; 
 
}）; 
  

如果在注册方法中定义了上述代码，将会产生全局影响，从而阻止用户名正在改变。为了限制它仅限于前端，如果（！App :: runningInBackend（））{/ * ... * /} ，可以考虑使用像这样的表达式。否则，您可以只在 onInit 页面代码函数内的该页面上监听事件。

I'm using OctoberCMS based on Laravel with the official Users plugin.

How can I modify this plugin to Disable or Deny Username Change?

The form can easily be hacked to allow change.

Plugin

Here is the file on GitHub I need to edit: Account.php

In the onUpdate() function, where it says $user->fill, it is saving all input fields.

I need to deny the username field in the function or with the validator.

public function onUpdate()
{
    if (!$user = $this->user()) {
        return;
    }

    $user->fill(post());
    $user->save();

OctoberCMS

I set Login attribute to Username.

User Update Details

The User Update Page displays the form inputs a user can change:

Full Name is a column in the Database called surname that I don't use.
Username is the column username, the one I use, but it's not included on the default form.

Though someone can add the username field in the browser just by inspect element, edit the HTML:

<div class="form-group">
    <label for="accountUsername">Username</label>
    <input name="username" type="text" id="accountUsername" value="Desired Username">
</div>

Submit and it will change the name and update the username column in the database.

解决方案

You could extend the User model with something like this:

\RainLab\User\Models\User::extend(function($model) {

    $model->bindEvent('model.beforeUpdate', function() use ($model) {

        if ($model->isDirty('username')) {

            throw new \ValidationException(['username' => 'Sorry!...']);

        }

    });

});

The above code will have a global impact, if defined in a registration method, preventing the username from ever being changed. To restrict it only to the front-end, consider using an expression like if (!App::runningInBackend()) { /* ... */ }. Otherwise you could simply listen to the event on that page only, inside the onInit page code function.

这篇关于修改OctoberCMS Laravel插件以禁用表单用户名更改的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！