Project

General

Profile

Actions

Defect #42106

open

Member roles are incorrectly added when a user's memberships are updated

Added by Thomas Löber 4 days ago. Updated about 1 hour ago.

Status:
Confirmed
Priority:
Normal
Assignee:
Category:
Permissions and roles
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed
Affected version:

Description

Member roles are incorrectly added when a user's memberships are updated on the user's Projects tab.

Setup:
  • 2 Roles: R1 and R2
  • 2 Groups: G1 and G2
  • G1 has role R1
  • G2 has roles R1 and R2
  • User is in groups G1 and G2
    ➔ that means the user has two inherited roles: R1 inherited by G1 and G2, and R2 inherited by G2
Steps to reproduce:
  • On the user's Projects tab click on Edit and then on Save without changing any checkboxes
  • Remove the user from G1 and G2

Expected result: The user no longer has any roles.

Actual result: The user still has the role R1.

Reason: When the user's memberships are saved, any roles inherited by more than one group are added as non-inherited roles.

Solution: Fix Member#role_ids=:

   def role_ids=(arg)
     ids = (arg || []).collect(&:to_i) - [0]
     # Keep inherited roles
-    ids += member_roles.select {|mr| !mr.inherited_from.nil?}.collect(&:role_id)
+    ids |= member_roles.select {|mr| !mr.inherited_from.nil?}.collect(&:role_id)

Files

add_test.diff (1.95 KB) add_test.diff Mizuki ISHIKAWA, 2025-01-17 07:06
Actions #1

Updated by Mizuki ISHIKAWA 2 days ago

I was able to reproduce the issue in my development environment as well.
When I apply the attached patch that adds a test and run the test, it fails with the current trunk code, as shown below.

# Running:

F

Failure:
MemberTest#test_update_roles_with_inherited_roles [test/unit/member_test.rb:86]:
--- expected
+++ actual
@@ -1 +1 @@
-[[1, 13], [1, 15], [2, 17], [3, nil]]
+[[1, 13], [1, 15], [2, 17], [3, nil], [1, nil]]

The failure occurs because at the moment of calling test_user_member.set_editable_role_ids([3]), role1 inherited from the group is unexpectedly assigned directly to the user.
When I modify the code based on the solution and then run the test, it passes successfully.

Actions #2

Updated by Go MAEDA 2 days ago

  • Status changed from New to Confirmed
  • Target version set to 5.1.6
Actions #3

Updated by Go MAEDA about 1 hour ago

  • Assignee set to Go MAEDA
  • Resolution set to Fixed

Committed the fix in r23449. Thank you for your contribution.

Actions

Also available in: Atom PDF