Skip to content

Content-Permissions API parameter combination behavior #4323

@toras9000

Description

@toras9000

Describe the Bug

In the UPDATE endpoint of the Content-Permissions API, the owner ID may not be updated depending on the combination of other parameters.
Specifically, if both owner_id and fallback_permissions are specified, the owner will not be updated.
If only owner_id is specified, or if owner_id and role_permissions are specified, the update will be done as specified.

Steps to Reproduce

The following request parameters will not update the owner
- {"owner_id":10,"fallback_permissions":{"inheriting":false,"view":true,"create":false,"update":false,"delete":false}}

Expected Behaviour

I opened this as a bug issue, but I am not sure if this was intended.
Perhaps the owner should be changed, regardless of the combination of parameters.

Screenshots or Additional Context

I think the reason is that in updateFromApiRequestData() in PermissionsUpdater.php, the $data variable is replaced in the middle.

Browser Details

No response

Exact BookStack Version

v23.05.02

PHP Version

No response

Hosting Environment

Docker image, lscr.io/linuxserver/bookstack:version-v23.05.2

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions