Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Content-Permissions API parameter combination behavior #4323

Closed
toras9000 opened this issue Jun 16, 2023 · 2 comments
Closed

Content-Permissions API parameter combination behavior #4323

toras9000 opened this issue Jun 16, 2023 · 2 comments
Labels
Milestone

Comments

@toras9000
Copy link

Describe the Bug

In the UPDATE endpoint of the Content-Permissions API, the owner ID may not be updated depending on the combination of other parameters.
Specifically, if both owner_id and fallback_permissions are specified, the owner will not be updated.
If only owner_id is specified, or if owner_id and role_permissions are specified, the update will be done as specified.

Steps to Reproduce

The following request parameters will not update the owner
- {"owner_id":10,"fallback_permissions":{"inheriting":false,"view":true,"create":false,"update":false,"delete":false}}

Expected Behaviour

I opened this as a bug issue, but I am not sure if this was intended.
Perhaps the owner should be changed, regardless of the combination of parameters.

Screenshots or Additional Context

I think the reason is that in updateFromApiRequestData() in PermissionsUpdater.php, the $data variable is replaced in the middle.

Browser Details

No response

Exact BookStack Version

v23.05.02

PHP Version

No response

Hosting Environment

Docker image, lscr.io/linuxserver/bookstack:version-v23.05.2

@ssddanbrown
Copy link
Member

Good spot, and thank you very much for raising @toras9000. Can confirm.
Bad variable scoping/naming on my part.

Will assign to be fixed, with testing updated to cover, for next feature release.

ssddanbrown added a commit that referenced this issue Jun 20, 2023
Fixes issue where providing owner_id alongside certain
fallback_permissions would cause the owner change not to take affect,
due to bad variable shadowing.

For #4323
@ssddanbrown
Copy link
Member

This is now addressed in 41c3ed1, and will be part of the next feature release.
Thanks again @toras9000!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

2 participants