| @@ -901,8 +901,10 @@ | ||
| 901 | 901 | $this->upload_avatar( $userid ); |
| 902 | 902 | } |
| 903 | 903 | |
| 904 | 904 | //Update Custom Fields |
| 905 | + // $custom_fields is still the raw $_POST['data']. The same values were merged into $user, where validate() has since dropped every field the current user may not edit and sanitize() has cleaned the rest, so read them back from $user: a key that is still there is one this user was allowed to submit, and its value is the sanitized one. | |
| 906 | + $custom_fields = array_intersect_key( $user, $custom_fields ); | |
| 905 | 907 | if( ! empty( $custom_fields ) && ( in_array( 'full', $type ) || in_array( 'custom_fields', $type ) ) ) { |
| 906 | 908 | $result_fields = $this->update_custom_fields( $userid, $custom_fields, false ); |
| 907 | 909 | } |
| 908 | 910 | |
