diff --git a/public/index.php b/public/index.php index db179a0..cc84d95 100644 --- a/public/index.php +++ b/public/index.php @@ -712,7 +712,7 @@ if ($route === 'user_edit') { if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') { http_response_code(405); exit('Edit requires POST'); } verify_csrf(); $targetId = filter_var(scalar_input($_POST['user_id'] ?? null), FILTER_VALIDATE_INT); - $existingUsers = db()->query('SELECT id, name, email, role_id, is_active, r.name AS role_name FROM users u JOIN roles r ON r.id = u.role_id')->fetchAll(); + $existingUsers = db()->query('SELECT u.id, u.name, u.email, u.role_id, u.is_active, r.name AS role_name FROM users u JOIN roles r ON r.id = u.role_id')->fetchAll(); $target = null; foreach ($existingUsers as $candidate) if ((int)$candidate['id'] === (int)$targetId) { $target = $candidate; break; } if (!$target) { http_response_code(404); exit('User not found'); } $payload = ['name' => $_POST['name'] ?? null, 'email' => $_POST['email'] ?? null, 'role_id' => $_POST['role_id'] ?? null, 'is_active' => isset($_POST['is_active']) ? '1' : '0']; diff --git a/tests/UserAdministrationTest.php b/tests/UserAdministrationTest.php index 7cb5b19..12996c7 100644 --- a/tests/UserAdministrationTest.php +++ b/tests/UserAdministrationTest.php @@ -19,7 +19,7 @@ $password = $service->validatePasswordReset(['id' => 2], 'Strong-Password-42'); user_admin_assert($password['valid'] === true, 'A strong password reset should pass.'); $front = file_get_contents(dirname(__DIR__) . '/public/index.php'); user_admin_assert($front !== false && str_contains($front, "if (\$route === 'user_edit')") && str_contains($front, "if (\$route === 'user_delete')"), 'User edit and delete routes must exist.'); -user_admin_assert(str_contains($front, 'r.name AS role_name FROM users u JOIN roles r'), 'User edit must alias the role name from the roles table.'); +user_admin_assert(str_contains($front, 'SELECT u.id, u.name, u.email, u.role_id, u.is_active, r.name AS role_name FROM users u JOIN roles r'), 'User edit must qualify user columns when joining the roles table.'); user_admin_assert(str_contains($front, "role_name'] ?? '') !== 'Administrator'"), 'User deletion must be Administrator-only.'); printf("User administration tests: 5 passed\n");