837968 - Allow updating of user's groups via RPC

Status: RESOLVED DUPLICATE of bug 469196

(Bugzilla :: WebService, enhancement)

Description

[Simon Green]

Allows updates to a user's group privilege via RPC

Comment 1

[Simon Green]

Attachment: v1 patch

Comment 2

[Reed Loden [:reed]]

Where are ACLs handled to ensure the user submitting this request has access to modify that user's groups (and has bless privs for the groups in question)?

Comment 3

[Simon Green]

(In reply to Reed Loden [:reed] from comment #2)
> Where are ACLs handled to ensure the user submitting this request has access
> to modify that user's groups (and has bless privs for the groups in
> question)?

Bugzilla/WebService/User.pm, sub update

 252     # Reject access if there is no sense in continuing.
 253     $user->in_group('editusers')
 254         || ThrowUserError("auth_failure", {group  => "editusers",
 255                                            action => "edit",
 256                                            object => "users"});

Since being in editusers group trumps individual bless group rights, there was no point in checking bless rights for a particular group.

  -- simon

Comment 4

[Koosha KM]

That's not a good idea to write the SQL queries on WebServices interface. 
Also, there is already such bug: bug 469196 which depends on bug 442013.