1349188 - POST /rest/user does not create password for new user when a password is specified as an URL parameter

Status: UNCONFIRMED

(Bugzilla :: WebService, defect)

Description

[[e-mail]]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8

Steps to reproduce:

> Create user '[e-mail]'
curl -H "Content-Type: application/json" --data '{"email":"[e-mail]", "full_name":"toto", "password":"%ù%ù1234"}' 'http://bugzilla/rest/user?login=[e-mail]&password=CTO$PASSWORD1'

> try to login as [e-mail]
curl 'http://bugzilla/rest/login?login=[e-mail]&password=%ù%ù1234'


Actual results:

> Login failed.
{"documentation":"https://bugzilla.readthedocs.org/en/5.0/api/","error":true,"code":300,"message":"The login or password you entered is not valid."}

> A look at the database shows that the "password" field for login [e-mail] in "profiles" is '*'.


Expected results:

> login succeeded
{"id":5,"token":"5-3lhmlSw3ue"}

> Workaround : using an api_key or calling /rest/login first works.

> Possible cause: URL 'password' field and JSON 'password' field collide.

Comment 1

[[e-mail]]

oops. This 
> > try to login as [e-mail]
> curl 'http://bugzilla/rest/login?login=[e-mail]&password=%ù%ù1234'

should read 
curl 'http://bugzilla/rest/login?login=[e-mail]&password=%ù%ù1234'

Comment 2

[Dylan Hardison [:dylan] (he/him)]

I'll take a look at this -- it should work.
But I'd recommend against using username/password for REST and instead make use of API keys.