From a8afdc6019bc25d5334eba07e9d0a6198d5e7908 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?=
 <barisusakli@gmail.com>
Date: Wed, 8 Dec 2021 18:38:02 -0500
Subject: [PATCH] fix: #10069, don't modify fields array

use a single setObjectFields for the profile update
---
 src/user/data.js    |  6 +++++-
 src/user/profile.js | 12 +++++++-----
 test/user.js        |  6 ++++++
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/src/user/data.js b/src/user/data.js
index fe5b8dc19e..d784a7efe7 100644
--- a/src/user/data.js
+++ b/src/user/data.js
@@ -52,11 +52,15 @@ module.exports = function (User) {
 		uids = uids.map(uid => (isNaN(uid) ? 0 : parseInt(uid, 10)));
 
 		const fieldsToRemove = [];
+		fields = fields.slice();
 		ensureRequiredFields(fields, fieldsToRemove);
 
 		const uniqueUids = _.uniq(uids).filter(uid => uid > 0);
 
-		const results = await plugins.hooks.fire('filter:user.whitelistFields', { uids: uids, whitelist: fieldWhitelist.slice() });
+		const results = await plugins.hooks.fire('filter:user.whitelistFields', {
+			uids: uids,
+			whitelist: fieldWhitelist.slice(),
+		});
 		if (!fields.length) {
 			fields = results.whitelist;
 		} else {
diff --git a/src/user/profile.js b/src/user/profile.js
index a8d1b02d1d..6cbfc53163 100644
--- a/src/user/profile.js
+++ b/src/user/profile.js
@@ -2,7 +2,6 @@
 'use strict';
 
 const _ = require('lodash');
-const async = require('async');
 const validator = require('validator');
 const winston = require('winston');
 
@@ -38,8 +37,8 @@ module.exports = function (User) {
 		await validateData(uid, data);
 
 		const oldData = await User.getUserFields(updateUid, fields);
-
-		await async.each(fields, async (field) => {
+		const updateData = {};
+		await Promise.all(fields.map(async (field) => {
 			if (!(data[field] !== undefined && typeof data[field] === 'string')) {
 				return;
 			}
@@ -53,9 +52,12 @@ module.exports = function (User) {
 			} else if (field === 'fullname') {
 				return await updateFullname(updateUid, data.fullname);
 			}
+			updateData[field] = data[field];
+		}));
 
-			await User.setUserField(updateUid, field, data[field]);
-		});
+		if (Object.keys(updateData).length) {
+			await User.setUserFields(updateUid, updateData);
+		}
 
 		plugins.hooks.fire('action:user.updateProfile', {
 			uid: uid,
diff --git a/test/user.js b/test/user.js
index f07e27ae8e..eb9fd91c0b 100644
--- a/test/user.js
+++ b/test/user.js
@@ -724,6 +724,12 @@ describe('User', () => {
 			});
 		});
 
+		it('should not modify the fields array passed in', async () => {
+			const fields = ['username', 'email'];
+			await User.getUserFields(testUid, fields);
+			assert.deepStrictEqual(fields, ['username', 'email']);
+		});
+
 		it('should return an icon text and valid background if username and picture is explicitly requested', async () => {
 			const payload = await User.getUserFields(testUid, ['username', 'picture']);
 			const validBackgrounds = await User.getIconBackgrounds(testUid);