summaryrefslogtreecommitdiffstats
path: root/Bugzilla
diff options
context:
space:
mode:
authorMatt Tyson <mtyson@redhat.com>2016-02-07 13:43:35 +0100
committerFrédéric Buclin <LpSolit@gmail.com>2016-02-07 13:43:35 +0100
commitc81a842c51eb1bd8beddbadc865450bd4e4db0bf (patch)
tree024b5a0effa67f83c0ab6fb36d05709e47f4f093 /Bugzilla
parent8c54443dd24eb15576dd5c2ebfbc6ce174276b3c (diff)
downloadbugzilla-c81a842c51eb1bd8beddbadc865450bd4e4db0bf.tar.gz
bugzilla-c81a842c51eb1bd8beddbadc865450bd4e4db0bf.tar.xz
Bug 1237161: Allow users with bless permissions to update users group membership using WebService
r=LpSolit a=dkl
Diffstat (limited to 'Bugzilla')
-rw-r--r--Bugzilla/API/1_0/Resource/User.pm3
-rw-r--r--Bugzilla/WebService/User.pm10
2 files changed, 12 insertions, 1 deletions
diff --git a/Bugzilla/API/1_0/Resource/User.pm b/Bugzilla/API/1_0/Resource/User.pm
index 3f1b6272d..ec81cf66d 100644
--- a/Bugzilla/API/1_0/Resource/User.pm
+++ b/Bugzilla/API/1_0/Resource/User.pm
@@ -326,6 +326,7 @@ sub update {
# Reject access if there is no sense in continuing.
$user->in_group('editusers')
+ || $user->can_bless()
|| ThrowUserError("auth_failure", {group => "editusers",
action => "edit",
object => "users"});
@@ -343,6 +344,8 @@ sub update {
delete $values->{ids};
$dbh->bz_start_transaction();
+
+ $values = { groups => $values->{groups} } unless $user->in_group('editusers');
foreach my $user (@$user_objects){
$user->set_all($values);
}
diff --git a/Bugzilla/WebService/User.pm b/Bugzilla/WebService/User.pm
index 0ae76d70f..bacd08ba1 100644
--- a/Bugzilla/WebService/User.pm
+++ b/Bugzilla/WebService/User.pm
@@ -275,6 +275,7 @@ sub update {
# Reject access if there is no sense in continuing.
$user->in_group('editusers')
+ || $user->can_bless()
|| ThrowUserError("auth_failure", {group => "editusers",
action => "edit",
object => "users"});
@@ -292,6 +293,8 @@ sub update {
delete $values->{ids};
$dbh->bz_start_transaction();
+
+ $values = { groups => $values->{groups} } unless $user->in_group('editusers');
foreach my $user (@$user_objects){
$user->set_all($values);
}
@@ -709,7 +712,12 @@ B<EXPERIMENTAL>
=item B<Description>
-Updates user accounts in Bugzilla.
+Updates user accounts in Bugzilla. To use this method, you must be a member
+of the C<editusers> group.
+
+If you are not in the C<editusers> group, you may
+add or remove users from groups if you have bless permissions for the groups
+you wish to modify. All other changes will be ignored.
=item B<REST>