= Details =

## please fill this in
 Applies to:: !MoinMoin version 1.5.4
 Purpose:: Insure items from user_form_remove aren't processed, to prevent spoofing the form submission
 Description:: When the 'UserPreferences' form is created, items from user_form_remove are missed off; however, an attacker could still send a spoofed form submission including the missed-off items.  Note that this patch is probably not complete, and a more thorough treatment is likely needed.  I don't think it's worth bothering to emit an error, since this kind of spoof shouldn't happen accidentally. ;-)  Anyway, this patch is meant to just point out the generic security issue.

= Patch =

## we prefer that you send the patch in an attachment to avoid whitespace issues
## you should probably change the name of the attachment here
{{attachment:formspoof.patch}}

= Discussion =

= Plan =
## This part is for Moin``Moin developers:

 * Priority: 
 * Assigned to:
 * Status: 

----
CategoryMoinMoinPatch