Content-Permissions API parameter combination behavior #3865

New Issue

OVERLORD · 2026-02-05T07:42:52+03:00

OVERLORD commented

2026-02-05 07:42:52 +03:00

Originally created by @toras9000 on GitHub (Jun 16, 2023).

Describe the Bug

In the UPDATE endpoint of the Content-Permissions API, the owner ID may not be updated depending on the combination of other parameters.
Specifically, if both owner_id and fallback_permissions are specified, the owner will not be updated.
If only owner_id is specified, or if owner_id and role_permissions are specified, the update will be done as specified.

Steps to Reproduce

The following request parameters will not update the owner
- {"owner_id":10,"fallback_permissions":{"inheriting":false,"view":true,"create":false,"update":false,"delete":false}}

Expected Behaviour

I opened this as a bug issue, but I am not sure if this was intended.
Perhaps the owner should be changed, regardless of the combination of parameters.

Screenshots or Additional Context

I think the reason is that in updateFromApiRequestData() in PermissionsUpdater.php, the $data variable is replaced in the middle.

Browser Details

No response

Exact BookStack Version

v23.05.02

PHP Version

No response

Hosting Environment

Docker image, lscr.io/linuxserver/bookstack:version-v23.05.2

Originally created by @toras9000 on GitHub (Jun 16, 2023). ### Describe the Bug In the UPDATE endpoint of the Content-Permissions API, the owner ID may not be updated depending on the combination of other parameters. Specifically, if both `owner_id` and `fallback_permissions` are specified, the owner will not be updated. If only `owner_id` is specified, or if `owner_id` and `role_permissions` are specified, the update will be done as specified. ### Steps to Reproduce The following request parameters will not update the owner - `{"owner_id":10,"fallback_permissions":{"inheriting":false,"view":true,"create":false,"update":false,"delete":false}}` ### Expected Behaviour I opened this as a bug issue, but I am not sure if this was intended. Perhaps the owner should be changed, regardless of the combination of parameters. ### Screenshots or Additional Context I think the reason is that in `updateFromApiRequestData()` in `PermissionsUpdater.php`, the `$data` variable is replaced in the middle. ### Browser Details _No response_ ### Exact BookStack Version v23.05.02 ### PHP Version _No response_ ### Hosting Environment Docker image, lscr.io/linuxserver/bookstack:version-v23.05.2

OVERLORD added the 🐛 Bug label 2026-02-05 07:42:52 +03:00

OVERLORD closed this issue

2026-02-05 07:42:54 +03:00

OVERLORD commented

2026-02-05 07:43:00 +03:00

@ssddanbrown commented on GitHub (Jun 17, 2023):

Good spot, and thank you very much for raising @toras9000. Can confirm.
Bad variable scoping/naming on my part.

Will assign to be fixed, with testing updated to cover, for next feature release.

@ssddanbrown commented on GitHub (Jun 17, 2023): Good spot, and thank you very much for raising @toras9000. Can confirm. Bad variable scoping/naming on my part. Will assign to be fixed, with testing updated to cover, for next feature release.

OVERLORD commented

2026-02-05 07:43:05 +03:00

@ssddanbrown commented on GitHub (Jun 20, 2023):

This is now addressed in 41c3ed154b, and will be part of the next feature release.
Thanks again @toras9000!

@ssddanbrown commented on GitHub (Jun 20, 2023): This is now addressed in 41c3ed154b79a52e97c9c6c9fd3235b4bfe26113, and will be part of the next feature release. Thanks again @toras9000!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3865