You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the UPDATE endpoint of the Content-Permissions API, the owner ID may not be updated depending on the combination of other parameters.
Specifically, if both owner_id and fallback_permissions are specified, the owner will not be updated.
If only owner_id is specified, or if owner_id and role_permissions are specified, the update will be done as specified.
Steps to Reproduce
The following request parameters will not update the owner
- {"owner_id":10,"fallback_permissions":{"inheriting":false,"view":true,"create":false,"update":false,"delete":false}}
Expected Behaviour
I opened this as a bug issue, but I am not sure if this was intended.
Perhaps the owner should be changed, regardless of the combination of parameters.
Screenshots or Additional Context
I think the reason is that in updateFromApiRequestData() in PermissionsUpdater.php, the $data variable is replaced in the middle.
Fixes issue where providing owner_id alongside certain
fallback_permissions would cause the owner change not to take affect,
due to bad variable shadowing.
For #4323
Describe the Bug
In the UPDATE endpoint of the Content-Permissions API, the owner ID may not be updated depending on the combination of other parameters.
Specifically, if both
owner_id
andfallback_permissions
are specified, the owner will not be updated.If only
owner_id
is specified, or ifowner_id
androle_permissions
are specified, the update will be done as specified.Steps to Reproduce
The following request parameters will not update the owner
-
{"owner_id":10,"fallback_permissions":{"inheriting":false,"view":true,"create":false,"update":false,"delete":false}}
Expected Behaviour
I opened this as a bug issue, but I am not sure if this was intended.
Perhaps the owner should be changed, regardless of the combination of parameters.
Screenshots or Additional Context
I think the reason is that in
updateFromApiRequestData()
inPermissionsUpdater.php
, the$data
variable is replaced in the middle.Browser Details
No response
Exact BookStack Version
v23.05.02
PHP Version
No response
Hosting Environment
Docker image, lscr.io/linuxserver/bookstack:version-v23.05.2
The text was updated successfully, but these errors were encountered: