Jakub Zych b6b7ac7534 fix: registration fills only an explicit allow-list and never takes the IP columns from the body ...

User.RegisterFillable lists what a registration body may set: name,
surname, email, password, preferred_locale and marketing_consent.
RegisterUser fills from it instead of Fillable, so organisation_id,
organisation_role, is_onboarded and must_change_password can no longer be
mass-assigned through POST /register, and created_ip_address and
last_ip_address come only from RegisterOptions.IP. Fillable is unchanged
for the admin form and trusted application code.

2026-10-22 03:03:18 +02:00

15 KiB

Raw Blame History

View Raw