Skip to content

User: Fix profile edit issues (hide deprecated theme, resolve CSRF) #7425

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
christianbeeznest merged 1 commit into from
Jan 24, 2026
Merged

User: Fix profile edit issues (hide deprecated theme, resolve CSRF) #7425

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/CoreBundle/Controller/AccountController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,9 +92,14 @@ public function edit(
return new RedirectResponse($url);
}

// Legacy Chamilo CSRF token (sec_token) used by old endpoints (extra fields/tags, etc).
// This prevents "CSRF error" warnings from legacy flows while the Symfony form still saves correctly.
$legacyToken = Security::get_token();

return $this->render('@ChamiloCore/Account/edit.html.twig', [
'form' => $form->createView(),
'user' => $user,
'legacy_token' => $legacyToken,
]);
}

Expand Down
17 changes: 15 additions & 2 deletions src/CoreBundle/Form/ProfileType.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,9 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
$editableHigh = $expand(\is_array($changeableOptions) ? $changeableOptions : []);

$languages = array_flip($this->languageRepository->getAllAvailableToArray(true, true));
$ignoredKeys = [
'theme',
];

// Core fields map (keys must align with settings keys)
$fieldsMap = [
Expand Down Expand Up @@ -117,6 +120,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
],
],
],

// Timezone will be added below if visible (fine JSON or fallback)
'timezone' => [
'field' => 'timezone',
Expand All @@ -140,7 +144,10 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
// Visibility (core):
// Strict when $hasFine: only keys present in $fieldsVisibility are visible.
// Otherwise, fallback to visible_options.
$isCoreVisible = function (string $key) use ($fieldsVisibility, $visibleHigh, $hasFine): bool {
$isCoreVisible = function (string $key) use ($fieldsVisibility, $visibleHigh, $hasFine, $ignoredKeys): bool {
if (\in_array($key, $ignoredKeys, true)) {
return false;
}
if ($hasFine) {
return \array_key_exists($key, $fieldsVisibility);
}
Expand All @@ -150,7 +157,10 @@ public function buildForm(FormBuilderInterface $builder, array $options): void

// Editability (core):
// If key is in fine JSON, its boolean decides; otherwise fallback to changeable_options.
$isCoreEditable = function (string $key) use ($fieldsVisibility, $editableHigh): bool {
$isCoreEditable = function (string $key) use ($fieldsVisibility, $editableHigh, $ignoredKeys): bool {
if (\in_array($key, $ignoredKeys, true)) {
return false;
}
if (\array_key_exists($key, $fieldsVisibility)) {
return (bool) $fieldsVisibility[$key];
}
Expand Down Expand Up @@ -221,6 +231,9 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
if ($hasFine) {
// Strict: only extras listed in fine JSON
foreach ($fieldsVisibility as $key => $bool) {
if (\in_array($key, $ignoredKeys, true)) {
continue;
}
if (!\in_array($key, $coreKeys, true)) {
$extraAllowlist[] = $key; // visible
$extraEditableMap[$key] = (bool) $bool; // editable
Expand Down
15 changes: 11 additions & 4 deletions src/CoreBundle/Resources/views/Account/edit.html.twig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,14 @@
document.addEventListener("DOMContentLoaded", function () {
$('.select2_user_rel_tag').each(function(i, obj) {
let fieldId = '&field_id=' + $(this).attr('data.field_id');

// Legacy CSRF token for old Chamilo AJAX endpoints.
// This prevents "CSRF error" warnings coming from legacy token checks.
let legacyToken = '&sec_token={{ legacy_token }}';

$(this).select2({
ajax: {
url: '/main/inc/ajax/extra_field.ajax.php?{{ { 'name' : '', 'a': 'search_tags', 'type': 'user'}|url_encode }}' + fieldId,
url: '/main/inc/ajax/extra_field.ajax.php?{{ { 'name' : '', 'a': 'search_tags', 'type': 'user'}|url_encode }}' + fieldId + legacyToken,
processResults: function (data) { return { results: data.items } }
},
cache: false,
Expand All @@ -28,7 +33,7 @@
$(this).on('select2:unselect', function (e) {
let fieldId = '&tag_id=' + e.params.data.element.dataset.id;
$.ajax({
url: '/main/inc/ajax/extra_field.ajax.php?{{ { 'a': 'delete_tag', 'type': 'user'}|url_encode }}' + fieldId,
url: '/main/inc/ajax/extra_field.ajax.php?{{ { 'a': 'delete_tag', 'type': 'user'}|url_encode }}' + fieldId + legacyToken,
success: function(data) {}
});
});
Expand All @@ -49,6 +54,8 @@
</div>
<div class="flex-grow">
{{ form_start(form, { 'action': path('chamilo_core_account_edit'), 'attr': { 'class': 'edit' } }) }}
{# Legacy Chamilo CSRF token used by old token checks (sec_token). #}
<input type="hidden" name="sec_token" value="{{ legacy_token }}" />
{{ form_widget(form, {'attr': {'class': 'flex flex-col gap-4'}}) }}

<div>
Expand All @@ -58,9 +65,9 @@
</div>
</div>

{# Flatpickr JS desde /build #}
{# Flatpickr JS from /build #}
<script src="{{ asset('build/flatpickr/flatpickr.min.js') }}"></script>
{# (Opcional) Localización, si quieres: <script src="/build/flatpickr/l10n/fr.js"></script> #}
{# Optional locale example: <script src="/build/flatpickr/l10n/fr.js"></script> #}
<script>
document.addEventListener('DOMContentLoaded', function () {
if (window.flatpickr) {
Expand Down
Loading