Merge pull request #351 from BillHeaton/ReCaptcha-Updates

#347 Only pass fields that are known to be in the User Model

src/User/Controller/RegistrationController.php

@@ -88,6 +88,9 @@ class RegistrationController extends Controller
         ];
     }
 
+    /**
+     * {@inheritdoc}
+     */
     public function actionRegister()
     {
         if (!$this->module->enableRegistration) {
@@ -102,8 +105,19 @@ class RegistrationController extends Controller
 
         if ($form->load(Yii::$app->request->post()) && $form->validate()) {
             $this->trigger(FormEvent::EVENT_BEFORE_REGISTER, $event);
+
             /** @var User $user */
-            $user = $this->make(User::class, [], $form->attributes);
+
+            // Create a temporay $user so we can get the attributes, then get
+            // the intersection between the $form fields  and the $user fields.
+            $user = $this->make(User::class, [] );
+            $fields = array_intersect_key($form->attributes, $user->attributes);
+
+             // Becomes password_hash
+            $fields['password'] = $form['password'];
+
+            $user = $this->make(User::class, [], $fields );
+
             $user->setScenario('register');
             $mailService = MailFactory::makeWelcomeMailerService($user);
 
@@ -133,6 +147,9 @@ class RegistrationController extends Controller
         return $this->render('register', ['model' => $form, 'module' => $this->module]);
     }
 
+    /**
+     * {@inheritdoc}
+     */
     public function actionConnect($code)
     {
         /** @var SocialNetworkAccount $account */
@@ -174,6 +191,9 @@ class RegistrationController extends Controller
         );
     }
 
+    /**
+     * {@inheritdoc}
+     */
     public function actionConfirm($id, $code)
     {
         /** @var User $user */
@@ -210,6 +230,9 @@ class RegistrationController extends Controller
         );
     }
 
+    /**
+     * {@inheritdoc}
+     */
     public function actionResend()
     {
         if ($this->module->enableEmailConfirmation === false) {