a bug in user_create function

[progmboy]

    function user_create( $name, $email, $password, $type )
    {
        $success = false;

        if( user_isadministrator() )
        {
            if( user_valid_password( $password ) or !ser_valid_username( $name ) )
            {
                $sql  = "INSERT INTO users ( name, email, password, type ) VALUES ";
                $sql .= "( '" . mysql_real_escape_string( $name ) . "', '" . mysql_real_escape_string( $email ) . "', '" . mysql_real_escape_string( sha1( GRINDER_SALT . $password ) ) . "', '" . mysql_real_escape_string( $type ) . "' );";

                $result = mysql_query( $sql );
                if( $result )
                {
                    $success = true;
                    mysql_free_result( $result );
                }
            }
        }

        return $success;
    }

if( user_valid_password( $password ) or !ser_valid_username( $name ) ) should be if( user_valid_password( $password ) and user_valid_username( $name ) )

[stephenfewer]

Thanks!