# 自定义下拉用户字段包含不可选的值

**URL:** <https://meta.discourse.org/t/custom-dropdown-user-field-contains-unselectable-value/402557>\
**Category:** Bug\
**Tags:** user-custom-fields\
**Created:** [2026年五月9日 10:30 UTC](https://meta.discourse.org/t/custom-dropdown-user-field-contains-unselectable-value/402557 "2026-05-09T10:30:18Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![ted](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ted/32/283882_2.png) [@ted](https://meta.discourse.org/u/ted)\
**Post date:** [2026年五月14日 02:09 UTC](https://meta.discourse.org/t/custom-dropdown-user-field-contains-unselectable-value/402557/3 "2026-05-14T02:09:04Z")

</div>

@Lilly 说得对。后端方面的不信任程度还不够。

既然这个问题出现了，我决定检查一下它是否也会影响个人资料页面，结果发现并不会。当用户更新个人资料时，我们会正确地清理数值。这使得将相同的清理逻辑复制到注册端点变得相对简单。相关 PR 如下：

> <https://github.com/discourse/discourse/pull/40018>
>
> \## What is the problem?
> 
> When signing up and the sign-up form contains custom …user fields of type "dropdown" or "multi-select", the client can send any value and it will be stored in the back-end.
> 
> \## How does this fix it?
> 
> We are correctly guarding against this in the profile update endpoint, so this PR just lifts the protection we have there to the sign-up endpoint as well.
> 
> \*\*Note:\*\* The \_real\_ fix is probably to shift the validation logic away from the controller and into the user fields module.

> [@AquaL1te](#):
>
> 但这是否也可能是一个安全问题？

我认为从技术上讲并不是。是的，用户可以输入任意值，但在任何地方渲染之前都会应用清理（因此不存在 XSS 漏洞）。而且注册端点已经正确应用了长度限制（因此不存在 DoS 漏洞）。

---

_[View the full topic](https://meta.discourse.org/t/custom-dropdown-user-field-contains-unselectable-value/402557)._