Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Background Problem

The site I'm working right now uses custom front-end forms for content, terms and user editing and creation. Access to wp-admin is blocked for non administrator.

All of them uses basic wp_ajax functionality.

On the user editing form, the function updates the user data using wp_update_user() and saves the meta field using update_user_meta().

Just now i found out that one of the saved meta field is saved to another user ID (mine, administrator) by someone else.

The code wasn't changed because it works, even after I updated the overwritten user meta, using the same function.

Code

Here is the stripped code that saves the meta field.

add_action('wp_ajax_edit-author', 'process_edit_author');

function process_edit_author() {

global $current_user;
if ( empty($_POST) || !wp_verify_nonce($_POST[$current_user->user_login],'edit-author') ) {
    echo 'You targeted the right function, but sorry, your nonce did not verify.';
    die();
} else {


    $profile_upload = $_FILES['profile-picture'];

    if ($profile_upload['name'][0]) {
        $profile_picture = attach_uploads($profile_upload);
        update_user_meta( $current_user->ID, 'profile-picture', $profile_picture[0]);
    }

    wp_redirect($return);
    exit;

    die();
}
}

The attach_uploads() saves the uploaded file as attachment. The first file attachment ID then is saved to the user meta.

Analysist

So far I can only tell that the image is uploaded by someone else's account, because the author of the attachment is not me.

Need Help

Does anyone have found this problem? Where and how should I debug this problem? How can I prevent this to happen again?

Thank you in advance .

share|improve this question

1 Answer 1

up vote 0 down vote accepted

That's likely because you are using $current_user->ID, which always refers to the currently logged in user, or when "empty" object if not logged in (ID == 0). If you would like to update user meta on any other user you would have to supply the user ID of that user in the $_POST data as well.

share|improve this answer
    
Thank you @Simon, but I'm not really sure about it, especially since the function actually works (almost all the time that is). –  ifdion Feb 28 '13 at 17:39
    
Yes, it will work as long as you are not editing users other than yourself. See this note in the wp_get_current_user () documentation, it says ID is 0 when the user is not logged in. Perhaps other functions will temporarily overwrite the $current_user (though I doubt it). I would recommend you use a function such as get_userdata() instead and store user ID's as needed by your forms/update methods. –  Simon Feb 28 '13 at 19:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.