From e65642be126b7c07ff6bff59db5b626cd0e66b34 Mon Sep 17 00:00:00 2001 From: David Unuigbe Date: Mon, 27 Apr 2026 10:15:31 +0200 Subject: [PATCH 1/3] Fix crash when editing profile for non-existent user --- app/controllers/users_controller.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 2a79cbaa1e..d49a6ada08 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -85,6 +85,12 @@ def edit else current_user end + unless @user + flash[:error] = I18n.t('users_controller.no_user_found_name', username: params[:id]) + redirect_to "/" + return + end + if current_user && current_user.uid == @user.uid || logged_in_as(['admin']) render template: "users/edit" else From a64762ef991261f202f48260b97f06a975aa9896 Mon Sep 17 00:00:00 2001 From: David Unuigbe Date: Mon, 27 Apr 2026 19:40:04 +0200 Subject: [PATCH 2/3] Handle numeric IDs and prevent crash when editing non-existent user --- app/controllers/users_controller.rb | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index d49a6ada08..7129174310 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -81,10 +81,14 @@ def update def edit @action = "update" # sets the form url @user = if params[:id] # admin only - User.find_by(username: params[:id]) - else - current_user - end + if params[:id].to_s =~ /\A\d+\z/ + User.find_by(id: params[:id]) + else + User.find_by(username: params[:id]) + end + else + current_user + end unless @user flash[:error] = I18n.t('users_controller.no_user_found_name', username: params[:id]) redirect_to "/" From 6ef460f0d1f843fa8dd6a3dc06ffe5cd27598778 Mon Sep 17 00:00:00 2001 From: David Unuigbe Date: Mon, 27 Apr 2026 21:03:28 +0200 Subject: [PATCH 3/3] Use route helpers for profile edit redirects --- app/controllers/users_controller.rb | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 7129174310..d31e02797f 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -91,7 +91,7 @@ def edit end unless @user flash[:error] = I18n.t('users_controller.no_user_found_name', username: params[:id]) - redirect_to "/" + redirect_to root_path return end @@ -99,7 +99,7 @@ def edit render template: "users/edit" else flash[:error] = I18n.t('users_controller.only_user_edit_profile', user: @user.name).html_safe - redirect_to "/profile/" + @user.name + redirect_to user_path(@user.username) end end @@ -157,14 +157,17 @@ def list def profile if current_user && params[:id].nil? - redirect_to "/profile/#{current_user.username}" + redirect_to user_path(current_user.username) elsif !current_user && params[:id].nil? - redirect_to "/" + redirect_to root_path else @profile_user = User.find_by(username: params[:id]) if !@profile_user - flash[:error] = I18n.t('users_controller.no_user_found_name', username: params[:id]) - redirect_to "/" + flash[:error] = I18n.t( + 'users_controller.no_user_found_name', + username: params[:id] + ) + redirect_to root_path else @title = @profile_user.name wikis = Revision.order("nid DESC") @@ -196,7 +199,7 @@ def profile flash.now[:error] = I18n.t('users_controller.user_has_been_banned') else flash[:error] = I18n.t('users_controller.user_has_been_banned') - redirect_to "/" + redirect_to root_path end elsif @profile_user.status == 5 flash.now[:warning] = I18n.t('users_controller.user_has_been_moderated')