[magento] Hundreds of new admin users with empty data after SUPEE-11314

There are a lot of new admin users in Magento Backend at System > Permissions > Users screen after upgrade or patch:


In `admin_user` table all fields for these users are NULL, i.e. email, username are NULL as well.

Cause

Bug in v1 version of SUPEE-11314 patch released on April 28, 2020.

Solution

Magento has released v2 version of SUPEE-11314 on May 12, 2020. It is required to revert v1 and apply v2 version of SUPEE-11314 to correct this.

The fix is in:

--- app/code/core/Mage/Admin/Model/Observer.php
+++ app/code/core/Mage/Admin/Model/Observer.php
@@ -133,6 +133,11 @@
     {
         $password = $observer->getEvent()->getPassword();
         $user = $observer->getEvent()->getUser();
+        $authResult = $observer->getEvent()->getResult();
+
+        if (!$authResult) {                                                                                                                                 
+            return;                                                                                                                                         
+        }                                                                                                                                                   
                                                                                                                                                             
         if (                                                                                                                                                
             !(bool) $user->getPasswordUpgraded() 

Posted in: supee-11314