update_user_meta updates to a wrong ID

Question

Background Problem

The site I'm working right now uses custom front-end forms for content, terms and user editing and creation. Access to wp-admin is blocked for non administrator.

All of them uses basic wp_ajax functionality.

On the user editing form, the function updates the user data using wp_update_user() and saves the meta field using update_user_meta().

Just now i found out that one of the saved meta field is saved to another user ID (mine, administrator) by someone else.

The code wasn't changed because it works, even after I updated the overwritten user meta, using the same function.

Code

Here is the stripped code that saves the meta field.

add_action('wp_ajax_edit-author', 'process_edit_author');

function process_edit_author() {

global $current_user;
if ( empty($_POST) || !wp_verify_nonce($_POST[$current_user->user_login],'edit-author') ) {
    echo 'You targeted the right function, but sorry, your nonce did not verify.';
    die();
} else {


    $profile_upload = $_FILES['profile-picture'];

    if ($profile_upload['name'][0]) {
        $profile_picture = attach_uploads($profile_upload);
        update_user_meta( $current_user->ID, 'profile-picture', $profile_picture[0]);
    }

    wp_redirect($return);
    exit;

    die();
}
}

The attach_uploads() saves the uploaded file as attachment. The first file attachment ID then is saved to the user meta.

Analysist

So far I can only tell that the image is uploaded by someone else's account, because the author of the attachment is not me.

Need Help

Does anyone have found this problem? Where and how should I debug this problem? How can I prevent this to happen again?

Thank you in advance .

Answer 1

That's likely because you are using $current_user->ID, which always refers to the currently logged in user, or when "empty" object if not logged in (ID == 0). If you would like to update user meta on any other user you would have to supply the user ID of that user in the $_POST data as well.