Fix profile fields save: use direct SQL to bypass model whitelist

Magento's admin/user model _beforeSave() only persists a whitelist
of fields (firstname, lastname, email, password, etc.). Custom
columns (tel, gender, race, dob, nric_fin, linkedin_url, profile_image)
are now saved via direct SQL UPDATE after the model save.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: alfredang

app/code/local/MMD/Adminhtml/controllers/System/AccountController.php

@@ -18,11 +18,13 @@ public function saveAction()
             ->setLastname($this->getRequest()->getParam('lastname', false))
             ->setEmail(strtolower($this->getRequest()->getParam('email', false)));
 
-        // Profile fields
+        // Profile fields — saved directly via SQL since core model
+        // _beforeSave() only persists a whitelist of fields
+        $profileData = array();
         $profileFields = array('tel', 'gender', 'race', 'dob', 'nric_fin', 'linkedin_url');
         foreach ($profileFields as $field) {
             $value = $this->getRequest()->getParam($field, null);
-            $user->setData($field, $value ?: null);
+            $profileData[$field] = ($value !== '' && $value !== null) ? $value : null;
         }
 
         // Profile image upload
@@ -38,15 +40,19 @@ public function saveAction()
                 $uploader->save($path, $filename);
 
                 // Delete old image
-                $oldImage = $user->getData('profile_image');
+                $resource = Mage::getSingleton('core/resource');
+                $oldImage = $resource->getConnection('core_read')->fetchOne(
+                    'SELECT profile_image FROM ' . $resource->getTableName('admin/user') . ' WHERE user_id = ?',
+                    array($userId)
+                );
                 if ($oldImage) {
                     $oldPath = $path . DS . $oldImage;
                     if (file_exists($oldPath)) {
                         @unlink($oldPath);
                     }
                 }
 
-                $user->setData('profile_image', $filename);
+                $profileData['profile_image'] = $filename;
             } catch (Exception $e) {
                 Mage::getSingleton('adminhtml/session')->addError('Image upload failed: ' . $e->getMessage());
             }
@@ -71,6 +77,16 @@ public function saveAction()
 
         try {
             $user->save();
+
+            // Save profile fields directly (bypasses model whitelist)
+            $resource = Mage::getSingleton('core/resource');
+            $write = $resource->getConnection('core_write');
+            $write->update(
+                $resource->getTableName('admin/user'),
+                $profileData,
+                'user_id = ' . (int)$userId
+            );
+
             Mage::getSingleton('adminhtml/session')->addSuccess(
                 Mage::helper('adminhtml')->__('The account has been saved.')
             );

commit-version.txt

@@ -1 +1 @@
-15-04-2026 02:12
+15-04-2026 02:22