From: Matt Tyson <mtyson@redhat.com>
Date: Sun, 7 Feb 2016 12:43:35 +0000 (+0100)
Subject: Bug 1237161: Allow users with bless permissions to update users group membership... 
X-Git-Tag: release-5.1.1~90
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c81a842c51eb1bd8beddbadc865450bd4e4db0bf;p=thirdparty%2Fbugzilla.git

Bug 1237161: Allow users with bless permissions to update users group membership using WebService
r=LpSolit a=dkl
---

diff --git a/Bugzilla/API/1_0/Resource/User.pm b/Bugzilla/API/1_0/Resource/User.pm
index 3f1b6272d5..ec81cf66d3 100644
--- a/Bugzilla/API/1_0/Resource/User.pm
+++ b/Bugzilla/API/1_0/Resource/User.pm
@@ -326,6 +326,7 @@ sub update {
 
     # Reject access if there is no sense in continuing.
     $user->in_group('editusers')
+        || $user->can_bless()
         || ThrowUserError("auth_failure", {group  => "editusers",
                                            action => "edit",
                                            object => "users"});
@@ -343,6 +344,8 @@ sub update {
     delete $values->{ids};
 
     $dbh->bz_start_transaction();
+
+    $values = { groups => $values->{groups} } unless $user->in_group('editusers');
     foreach my $user (@$user_objects){
         $user->set_all($values);
     }
diff --git a/Bugzilla/WebService/User.pm b/Bugzilla/WebService/User.pm
index 0ae76d70fe..bacd08ba17 100644
--- a/Bugzilla/WebService/User.pm
+++ b/Bugzilla/WebService/User.pm
@@ -275,6 +275,7 @@ sub update {
 
     # Reject access if there is no sense in continuing.
     $user->in_group('editusers')
+        || $user->can_bless()
         || ThrowUserError("auth_failure", {group  => "editusers",
                                            action => "edit",
                                            object => "users"});
@@ -292,6 +293,8 @@ sub update {
     delete $values->{ids};
 
     $dbh->bz_start_transaction();
+
+    $values = { groups => $values->{groups} } unless $user->in_group('editusers');
     foreach my $user (@$user_objects){
         $user->set_all($values);
     }
@@ -709,7 +712,12 @@ B<EXPERIMENTAL>
 
 =item B<Description>
 
-Updates user accounts in Bugzilla.
+Updates user accounts in Bugzilla. To use this method, you must be a member
+of the C<editusers> group.
+
+If you are not in the C<editusers> group, you may
+add or remove users from groups if you have bless permissions for the groups
+you wish to modify. All other changes will be ignored.
 
 =item B<REST>
 
diff --git a/docs/en/rst/api/core/v1/user.rst b/docs/en/rst/api/core/v1/user.rst
index e27211a7fa..b6aaa43e15 100644
--- a/docs/en/rst/api/core/v1/user.rst
+++ b/docs/en/rst/api/core/v1/user.rst
@@ -162,6 +162,10 @@ Update User
 Updates an existing user account in Bugzilla. You must be authenticated and be
 in the *editusers* group to perform this action.
 
+If you are not in the *editusers* group, you may add or remove users from groups
+if you have bless permissions for the groups you wish to modify. All other changes
+will be ignored.
+
 **Request**
 
 .. code-block:: text