humhub / rest

HumHub Rest API Module
24 stars 23 forks source link

On user creation, status is always 1 even if set to another value #143

Closed marc-farre closed 1 year ago

marc-farre commented 1 year ago

Steps to reproduce:

Create a new user using https://marketplace.humhub.com/module/rest/docs/html/user.html#tag/User/paths/~1user/post

In the POST data, set the status to 2:

"account": {
"username": "john.doe",
"email": "john.doe@example.com",
"status": 2,
"tagsField": [],
"language": "DE",
"authclient": "local",
"authclient_id": "0123456789"
},

The new user has status 1.

This is because no scenario is defined on the User model before loading data. And with no scenario, the status property is no returned User::safeAttributes().

So we need to set the scenario to User::SCENARIO_EDIT_ADMIN.

Problem: authclient and authclient_id are still not safe attributes with User::SCENARIO_EDIT_ADMIN.

Solution 1: in User::scenarios(), add 'authclient', 'authclient_id' to $scenarios[self::SCENARIO_EDIT_ADMIN]

Solution 2: create a new one such as User::SCENARIO_REST_API_EDIT_ADMIN. And in User::scenarios() we could add:

$scenarios[self::SCENARIO_REST_API_EDIT_ADMIN] = ['username', 'email', 'status', 'visibility', 'language', 'tagsField', 'authclient', 'authclient_id'];`
marc-farre commented 1 year ago

@luke- https://github.com/humhub/rest/pull/144 fixes the problem for the status property.

For authclient and authclient_id, see above (I did no test for my proposal).

yurabakhtin commented 1 year ago

@luke- This PR is related to the https://github.com/humhub/rest/pull/140 which was done only for update action, so yes we need the same fix for create action as well.

luke- commented 1 year ago

@marc-farre @yurabakhtin Thanks!