Ignore private fields input on user register

[gfpacheco]

Fixes #5834

• Ignore private fields before passing input to resolver

PS: I'm only using GraphQL so I don't know if the same bug could be used to exploit the REST API.

[codecov]

Codecov Report

Merging #6047 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #6047   +/-   ##
=======================================
  Coverage   19.34%   19.34%           
=======================================
  Files         863      863           
  Lines       12060    12060           
  Branches     1935     1935           
=======================================
  Hits         2333     2333           
  Misses       8153     8153           
  Partials     1574     1574           

Flag	Coverage Δ
#front	14.57% <ø> (ø)
#unit	39.96% <ø> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c9925f3...677b250. Read the comment docs.

[alexandrebodin]

Hey, thanks for your help ! You can however create a new input type for the register mutation instead of filtering the fields by end ;) You can add the new input type in the declaration field and update the query :)

[gfpacheco]

@alexandrebodin

Oh yes, I'm much happier with this solution. I wasn't sure that was something you would want, I didn't want to jump in changing input types, but that's definitely how things should be done.

[alexandrebodin]

LGTM, Thank you for this PR :D Will merge when test pass ;)

[alexandrebodin]

Hey @gfpacheco Looks like this is breaking the register mutation test :D

[gfpacheco]

Sorry, I just assumed the input name didn't matter, forgot you must declare it when using in a variable. Fixed

[alexandrebodin]

Hey @gfpacheco can you just verify the DCO check so we can merge your PR ? :D

[gfpacheco]

@alexandrebodin All the checks have passed and I also rebased the branch onto master

[alexandrebodin]

LGTM 👍 Thank you for this PR