[5.4] Allow PATCH /api/users/{super-user-id}

[OctavianC]

Pull Request for Issue #46766 .

Summary of Changes

The System - Action Logs plugin loads a form in the onContentPrepareForm event if the following conditions match:

• The context is com_users.profile or com_users.user - so whenever a com_users form is loaded
• The user ID is that of a Super User (core.admin permission)
• The Action Log - Joomla Plugin must be enabled
  This form prevents saving a Super User through an API PATCH request because it contains this field:

<field
	name="actionlogsNotify"
	type="radio"
	label="PLG_SYSTEM_ACTIONLOGS_NOTIFICATIONS"
	layout="joomla.form.field.radio.switcher"
	default="0"
	filter="integer"
	required="true"
	>
	<option value="0">JNO</option>
	<option value="1">JYES</option>
</field>

This field is required and fails validation since it's missing from the request. In my opinion the best way to handle this is to remove the required attribute as it also creates the illusion that the field must be turned on due to the required asterisk next to it (think of agreement mandatory fields).

Testing Instructions

• Look for your own (or another Super User) ID

• Create a PATCH request to that ID eg. https://[joomla-url]/api/index.php/v1/users/581 with a simple payload:

{
    "block": 1
}

If the above results in an error message such as:
Save failed with the following error: You can't save a user account without selecting at least one user group.
Either apply the PR #46750, download the latest nightly since that PR is already merged or adjust your payload to include some groups to speed things up and bypass the error:

{
    "block": 1,
    "groups": [8]
}

• Make sure that the field can be turned on from the administrator client:

- And turned off as well:

Actual result BEFORE applying this Pull Request

{"errors":[{"title":"Field required: Email Notifications"}]}

Expected result AFTER applying this Pull Request

{"errors":[{"title":"Save failed with the following error: You can't block yourself.","code":400}]}

Link to documentations

Please select:

• Documentation link for docs.joomla.org:

• No documentation changes for docs.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed

[exlemor]

I have tested this item ✅ successfully on bcbbc19

I have tested this successfully! Thanks @OctavianC! :)

I got the message: "title": "Save failed with the following error: You can't block yourself.", "code": 400 for my SU user and it worked/blocked for another SU user.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46768.}

[Megharaj170804]

I have tested this item ✅ successfully on bcbbc19

I inspected the file plugins/system/actionlogs/forms/actionlogs.xml and confirmed that the required="true" attribute has been removed from the actionlogsNotify field

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46768.}

[brianteeman]

@Megharaj170804 it is NOT enough to just check the code has changed - you must check that the code change does what it says it will do as written in the test instructions. That INCLUDES using the api to Create a PATCH request

I have removed your test at this time until you have done that

[Megharaj170804]

I have successfully tested this item ✅ on *bcbbc19*. Code Verification I confirmed that the required="true" attribute has been removed from the actionlogsNotify field in: plugins/system/actionlogs/forms/actionlogs.xml Field Attributes Verified - name="actionlogsNotify" - type="radio" - label="PLG_SYSTEM_ACTIONLOGS_NOTIFICATIONS" - layout="joomla.form.field.radio.switcher" - default="0" - filter="integer" - ✅ The required attribute is *not present* (confirmed removed) API Testing Following the provided test instructions, I performed API PATCH requests on Super User accounts. *Before the patch (expected behavior):* - Error returned: {"errors":[{"title":"Field required: Email Notifications"}]} *After the patch (confirmed behavior):* - The required field validation error is resolved - API PATCH requests to /api/v1/users/{super-user-id} proceed successfully - Proper validation errors are returned where applicable (e.g. *"You can't block yourself"* when attempting to block the currently authenticated Super User) Additional Testing - Verified that the field can still be toggled in the Administrator interface *(System → Users → Edit Super User)* - The misleading required asterisk is no longer displayed in the UI - The default value of "0" (No) is correctly applied when the field is not provided

[richard67]

@Megharaj170804 To correctly submit a test result it needs to go to the PR in the issue tracker here https://issues.joomla.org/tracker/joomla-cms/46768 and use the blue "Test this" button to submit a test result, otherwise it is not properly counted. I will set the result for you now, but please remember next time when testing PRs. Thanks in advance, and thanks for testing this one.

[richard67]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46768.}

[muhme]

✅ Final test before merge with JBT

• Seen error 400 'Field required: Email Notifications' and User > User Actions Log Options > Email Notifications is mandatory field before PR
• Applied PR with Patch Tester
• Changing only email address via API call for the same user account that owns the API token is possible, also for other user
• User > User Actions Log Options > Email Notifications is no more marked as mandatory field, it is still possible to enable and disable this field

[muhme]

Thank you @OctavianC for your contribution. Thank you @exlemor and @Megharaj170804 for testing. Thank you @brianteeman for supporting.