1237161 - Allow users with bless permissions to update users group membership using WebService

Status: RESOLVED FIXED

(Bugzilla :: WebService, enhancement)

Description

[Matt Tyson]

Attachment: bless.patch

If a user has bless permissions for a group, but not editusers itself, they can't add or remove users from that group using the Users.update or /rest/user/id RPC methods.

I think the simplest way of doing this is to allow anyone that can bless permission to set groups only, and restricting the rest of the operations to anyone in the editusers group.

Attached is a patch to modify the RPC endpoints to do this.  Opinions?

Comment 1

[Frédéric Buclin]

Comment on attachment 8704470 [details] [diff] [review]
bless.patch

>+    # If there are any groups, allow someone with bless permission to set them.
>+    if (my $groups = delete $values->{groups}) {
>+        foreach my $user (@$user_objects) {
>+            $user->set_all({groups => $groups});
>+        }
>+    }
>+
>+    # Require editusers for all other operations.
>+    if ($user->in_group('editusers')) {
>+        foreach my $user (@$user_objects) {
>+            $user->set_all($values);
>+        }
>     }

You don't need to duplicate the foreach loop. You only need this first line right before the existing foreach loop:

    $values = { groups => $values->{groups} } unless $user->in_group('editusers');
    foreach my $user (@$user_objects) {
        $user->set_all($values);
    }

Also, you need to update the documentation to specify that users with bless privileges can also call this method.

Comment 2

[Matt Tyson]

Attachment: 1237161.patch

Ah, that's simpler.

Here's a new patch with documentation added.

Comment 3

[Frédéric Buclin]

Ah, I meant to document this change in docs/en/rst/api/core/v1/user.rst.

Comment 4

[Matt Tyson]

Attachment: 1237161.patch

Ah, my bad.

I've updated the rst documentation instead.

Comment 5

[Frédéric Buclin]

Comment on attachment 8704914 [details] [diff] [review]
1237161.patch

>+++ b/docs/en/rst/api/core/v1/user.rst

>+If you are not in *editusers* you may add or remove users from groups if you have
>+bless permissions for the groups you wish to modify.

The POD in Bugzilla/WebService/User.pm should be updated to also contain this comment. Also, this comment should also mention that all other changes will be ignored.

Otherwise, your patch looks good and works fine. Thanks! r=LpSolit

Comment 6

[Frédéric Buclin]

Requesting approval as this is an API change.

Comment 7

[Frédéric Buclin]

To ssh://[e-mail]/bugzilla/bugzilla.git
   8c54443..c81a842  master -> master