Don't allow customers to change own groups and status

aimeos · Aug 13, 2020 · 02cb20d · 02cb20d
1 parent 3a2f874
commit 02cb20d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/controller/frontend/src/Controller/Frontend/Customer/Standard.php b/controller/frontend/src/Controller/Frontend/Customer/Standard.php
@@ -129,7 +129,7 @@ public function editItem( $id, array $values )
 		$manager = \Aimeos\MShop\Factory::createManager( $this->getContext(), 'customer' );
 		$item = $manager->getItem( $id, ['customer/group'], true );
 
-		unset( $values['customer.id'] );
+		unset( $values['customer.id'], $values['customer.groups'], $values['customer.status'] );
 		$item->fromArray( $values );
 
 		return $manager->saveItem( $item );