*/
public $submitOnce = TRUE;
+ /**
+ * Used to make sure a malicious POST does not change is_reserved
+ *
+ * @var bool
+ */
+ protected $_isReserved = FALSE;
+
/**
* Explicitly declare the entity api name.
*/
if (empty($defaults['weight'])) {
$defaults['weight'] = CRM_Utils_Weight::getDefaultWeight('CRM_Event_DAO_ParticipantStatusType');
}
- $this->_isReserved = $defaults['is_reserved'] ?? NULL;
+ $this->_isReserved = $defaults['is_reserved'] ?? FALSE;
if ($this->_isReserved) {
$this->freeze(['name', 'class', 'is_active']);
}