From 6c3ad77ea5749d9a1951a5587c576772ff896073 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= <commits@skodak.org>
Date: Mon, 23 Sep 2013 20:54:55 +0200
Subject: [PATCH 1/3] MDL-41176 fix obvious bugs and typos in new user API

---
 lib/classes/user.php | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/classes/user.php b/lib/classes/user.php
index 40328847c2d..badf8540047 100644
--- a/lib/classes/user.php
+++ b/lib/classes/user.php
@@ -39,7 +39,7 @@ class core_user {
     const NOREPLY_USER = -10;
 
     /**
-     * Suppport user id.
+     * Support user id.
      */
     const SUPPORT_USER = -20;
 
@@ -160,9 +160,11 @@ class core_user {
             self::$supportuser = self::get_dummy_user_record();
             self::$supportuser->id = self::SUPPORT_USER;
             self::$supportuser->email = $CFG->supportemail;
-            self::$supportuser->firstname = $CFG->supportname ? $CFG->supportname : $supportuser->firstname;
+            if ($CFG->supportname) {
+                self::$supportuser->firstname = $CFG->supportname;
+            }
             self::$supportuser->username = 'support';
-            self::$supportuser->maildisplay = true;
+            self::$supportuser->maildisplay = '1'; // Show to all.
         }
 
         // Send support msg to admin user if nothing is set above.
@@ -191,7 +193,7 @@ class core_user {
 
     /**
      * Return true is user id is greater than self::NOREPLY_USER and
-     * alternetely check db.
+     * alternatively check db.
      *
      * @param int $userid user id.
      * @param bool $checkdb if true userid will be checked in db. By default it's false, and
@@ -199,6 +201,8 @@ class core_user {
      * @return bool true is real user else false.
      */
     public static function is_real_user($userid, $checkdb = false) {
+        global $DB;
+
         if ($userid < 0) {
             return false;
         }

From e113214618bd3eb6e92f681f7d16705ed7b82cd2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= <commits@skodak.org>
Date: Mon, 23 Sep 2013 21:15:19 +0200
Subject: [PATCH 2/3] MDL-41176 make sure fresh full user record is used when
 mailing email confirmation

---
 user/edit.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/user/edit.php b/user/edit.php
index 2a060d16ed4..ab1478a329c 100644
--- a/user/edit.php
+++ b/user/edit.php
@@ -236,15 +236,15 @@ if ($usernew = $userform->get_data()) {
     // save custom profile fields data
     profile_save_data($usernew);
 
-    // If email was changed and confirmation is required, send confirmation email now
+    // If email was changed and confirmation is required, send confirmation email now to the new address.
     if ($email_changed && $CFG->emailchangeconfirmation) {
-        $temp_user = fullclone($user);
+        $temp_user = $DB->get_record('user', array('id'=>$user->id), '*', MUST_EXIST);
         $temp_user->email = $usernew->preference_newemail;
 
         $a = new stdClass();
         $a->url = $CFG->wwwroot . '/user/emailupdate.php?key=' . $usernew->preference_newemailkey . '&id=' . $user->id;
         $a->site = format_string($SITE->fullname, true, array('context' => context_course::instance(SITEID)));
-        $a->fullname = fullname($user, true);
+        $a->fullname = fullname($temp_user, true);
 
         $emailupdatemessage = get_string('emailupdatemessage', 'auth', $a);
         $emailupdatetitle = get_string('emailupdatetitle', 'auth', $a);

From cf361a95015307cf8b594ebde95af7a3fda97f62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20S=CC=8Ckoda?= <commits@skodak.org>
Date: Mon, 23 Sep 2013 21:15:59 +0200
Subject: [PATCH 3/3] MDL-41176 do not set description and pw fields in $USER
 when editing own profile

---
 user/edit.php         | 10 +++++++---
 user/editadvanced.php |  4 ++++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/user/edit.php b/user/edit.php
index ab1478a329c..7c479ef9fb8 100644
--- a/user/edit.php
+++ b/user/edit.php
@@ -256,12 +256,16 @@ if ($usernew = $userform->get_data()) {
         }
     }
 
-    // reload from db
-    $usernew = $DB->get_record('user', array('id'=>$user->id));
+    // Reload from db, we need new full name on this page if we do not redirect.
+    $user = $DB->get_record('user', array('id'=>$user->id), '*', MUST_EXIST);
 
     if ($USER->id == $user->id) {
         // Override old $USER session variable if needed
-        foreach ((array)$usernew as $variable => $value) {
+        foreach ((array)$user as $variable => $value) {
+            if ($variable === 'description' or $variable === 'password') {
+                // These are not set for security nad perf reasons.
+                continue;
+            }
             $USER->$variable = $value;
         }
         // preload custom fields
diff --git a/user/editadvanced.php b/user/editadvanced.php
index 924ebb1a12f..122a4cc722c 100644
--- a/user/editadvanced.php
+++ b/user/editadvanced.php
@@ -240,6 +240,10 @@ if ($usernew = $userform->get_data()) {
     if ($user->id == $USER->id) {
         // Override old $USER session variable
         foreach ((array)$usernew as $variable => $value) {
+            if ($variable === 'description' or $variable === 'password') {
+                // These are not set for security nad perf reasons.
+                continue;
+            }
             $USER->$variable = $value;
         }
         // preload custom fields