API Invalid query parameter provided

[Monschichi]

Description:

With 4.8.0, at least, the user-list API doesn't work anymore as expected. With 4.7.1 it worked.

Steps to reproduce:

1. use example query https://developer.rocket.chat/reference/api/rest-api/endpoints/team-collaboration-endpoints/users-endpoints/get-users-list

Expected behavior:

response like documented

Actual behavior:

{"success":false,"error":"Invalid query parameter provided: \"{ active: true, type: { $in: ['user', 'bot'] } }\" [error-invalid-query]","errorType":"error-invalid-query","details":{"helperMethod":"parseJsonQuery"}}

Server Setup Information:

• Version of Rocket.Chat Server: 4.8.0
• Operating System: Debian buster
• Deployment Method: tar
• Number of Running Instances: 2
• DB Replicaset Oplog:
• NodeJS Version: v14.18.3
• MongoDB Version: 5.0.8

Client Setup Information

• Desktop App or Browser Version: curl
• Operating System:

Additional context

curl --location -g --request GET 'https://XXX/api/v1/users.list?query={ active: true, type: { $in: ['\''user'\'', '\''bot'\''] } }' \
--header 'X-Auth-Token: XXX' \
--header 'X-User-Id: XXX'
{"success":false,"error":"Invalid query parameter provided: \"{ active: true, type: { $in: ['user', 'bot'] } }\" [error-invalid-query]","errorType":"error-invalid-query","details":{"helperMethod":"parseJsonQuery"}}

Relevant logs:

[2022-06-02T10:29:13.796Z] WARN (API/6045 on XXX01): attribute query is deprecated
[2022-06-02T10:29:13.797Z] WARN (API/6045 on XXX01): Invalid query parameter provided "{ active: true, type: { $in: ['user', 'bot'] } }": {}

[ankar84]

Confirm that issue on 4.8.1 Some scripts are broken.

[r-souza]

Confirm on version 3.8.17 too

[markusstoll]

Could it be that commit 31ae30f30ad71d9e5a1b0cad494b3471a7dd8807 by @ggazzo changed things in a way that some queries do no longer work?

For me searching for customFields e.g. { "customFields.pkey" : { "$eq" : " + "my value"}} gives a Invalid query parameter provided: "{ "customFields.pkey" : { "$eq" : " + "10221"}}" [error-invalid-query] (this still worked on 4.7.2)

and querying for all fields using {"_id": false, "value": false} (according to https://developer.rocket.chat/reference/api/rest-api/endpoints/other-important-endpoints/query-and-fields-info#query-example) does no longer work too.

[dudanogueira]

Also for this endpoint: https://developer.rocket.chat/reference/api/rest-api/endpoints/omnichannel/omnichannel-endpoints/users/get-a-list-of-agents-or-managers

code: https://github.com/RocketChat/Rocket.Chat/blob/develop/apps/meteor/app/livechat/imports/server/rest/users.js