[ticket/17647] Do not treat gallery buttons as the avatar form submit#6993
Open
ECYaz wants to merge 1 commit into
Open
[ticket/17647] Do not treat gallery buttons as the avatar form submit#6993ECYaz wants to merge 1 commit into
ECYaz wants to merge 1 commit into
Conversation
The AJAX avatar upload copies the submit button's name and value into the request. Selecting the first submit input in the form picks the gallery's "Go" button when gallery avatars are enabled, so the server renders the gallery page instead of saving the uploaded avatar. Restrict the selection to the form's own submit area. PHPBB-17647
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist:
Tracker ticket:
https://tracker.phpbb.com/browse/PHPBB-17647
The AJAX avatar upload copies the name and value of the form's submit button into the request so the server treats it as a regular submission. Selecting the first submit input in the form picks the gallery's "Go" button when gallery avatars are enabled, because the UCP templates render it as a direct fieldset child ahead of the real submit button. The server then responds with the gallery page instead of saving the upload, and the avatar is silently discarded.
Restricting the selection to the form's submit area (
fieldset.submit-buttonsin the UCP and ACP group forms,fieldset.quickin the ACP user form) picks the correct button in all four places the cropper runs. Reproduced and verified on a live board: with gallery avatars enabled, uploads on the UCP profile page and the UCP group management page previously postedavatar_local_go=Goand nothing was saved; with the fix both post the real submit button and the avatar is stored and displayed. The ACP user and group pages were unaffected by the bug (their "Go" button is not a direct fieldset child) and select the same button as before.