MDL-18265 fixed regressions by hardfreeze security workaround - defaults were overriding locked values

user/edit_form.php

@@ -97,11 +97,12 @@ class user_edit_form extends moodleform {
                 }
             }
             
+            /// Next the customisable profile fields
+            profile_definition_after_data($mform, $user->id);
+
+        } else {
+            profile_definition_after_data($mform, 0);
         }
-
-        /// Next the customisable profile fields
-        profile_definition_after_data($mform);
-
     }
 
     function validation($usernew, $files) {

user/editadvanced_form.php

@@ -107,7 +107,7 @@ class user_editadvanced_form extends moodleform {
         }
 
         /// Next the customisable profile fields
-        profile_definition_after_data($mform);
+        profile_definition_after_data($mform, $userid);
     }
 
     function validation($usernew, $files) {

user/profile/lib.php

@@ -71,6 +71,20 @@ class profile_field_base {
             $this->edit_field_add($mform);
             $this->edit_field_set_default($mform);
             $this->edit_field_set_required($mform);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Tweaks the edit form
+     * @param   object   instance of the moodleform class
+     * $return  boolean
+     */
+    function edit_after_data(&$mform) {
+
+        if ($this->field->visible != PROFILE_VISIBLE_NONE
+          or has_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM))) {
             $this->edit_field_set_locked($mform);
             return true;
         }
@@ -151,6 +165,9 @@ class profile_field_base {
      * @param   object   instance of the moodleform class
      */
     function edit_field_set_locked(&$mform) {
+        if (!$mform->elementExists($this->inputname)) {
+            return;
+        }
         if ($this->is_locked() and !has_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM))) {
             $mform->hardFreeze($this->inputname);
             $mform->setConstant($this->inputname, $this->data);
@@ -350,18 +367,19 @@ function profile_definition(&$mform) {
     }
 }
 
-function profile_definition_after_data(&$mform) {
+function profile_definition_after_data(&$mform, $userid) {
     global $CFG, $DB;
-/*
+
+    $userid = ($userid < 0) ? 0 : (int)$userid;
+
     if ($fields = $DB->get_records('user_info_field')) {
         foreach ($fields as $field) {
             require_once($CFG->dirroot.'/user/profile/field/'.$field->datatype.'/field.class.php');
             $newfield = 'profile_field_'.$field->datatype;
-            $formfield = new $newfield($field->id);
-//TODO add: method into field class
-
+            $formfield = new $newfield($field->id, $userid);
+            $formfield->edit_after_data($mform);
         }
-    }*/
+    }
 }
 
 function profile_validation($usernew, $files) {