[4.1.4] (and [4.2.0dev3]) - Webservices PATCH to update a user fails with status 400

[aftertaf]

Steps to reproduce the issue

PREREQUISITES THAT I HAVE "validated"

-have a functional Postman Webservices API setup for your site
-validate that the SuperUser token can GET {{base_url}}/{{base_path}}/users/
-validate that PATCH of an existing custom user field: {{base_url}}/{{base_path}}/fields/users/{{field_id}} also works

ISSUE:
Once the above is tested OK, try to update a user with PATCH : {{base_url}}/{{base_path}}/users/{{user_id}}

The attempt to update a user with Postman generates this cURL code snippet:
curl --location --request PATCH 'https://www.mysite.xyz/api/index.php/v1/users/626'
--header 'Content-Type: application/json'
--header 'X-Joomla-Token: SomeRandomTextReplacingMyActualToken'
--data-raw '{"email":"new@example.org"}'

Expected result

In Postman :
-HTTP response 200
-Response of modified user in JSON format

Actual result

In Postman:
-Status : 400 : Bad request
"The request cannot be fulfilled due to bad syntax"

-JSON Body:
{"errors":[{"title":"The passwords you entered do not match. Please enter your desired password in the password field and confirm your entry by entering it in the confirm password field."}]}

System information (as much as possible)

debian 11, PHP 8.0.18, Apache fpm-fcgi
MariaDB - 10.5.15-MariaDB-0+deb11u1

Additional comments

Tested on 4.2.0-alpha3-dev and Joomla! 4.1.4 Stable [ Kuamini ] 24-May-2022 (both sites on same VM)

[toivo]

This is just to confirm that this issue happens with Postman in Joomla 4.1.5-dev using PHP 8.0.15 and Wampserver 3.2.9.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/37991.}

[alikon]

confirmed

[alikon]

please test #37994

[aftertaf]

Latest change by @alikon 14830e8 works :)
thanks !!!

[aftertaf]

I do have another "question", if i may...
Can it be possible to allow a user PATCH API call without needing to specify their groups ?
If I do a PATCH of a UserID with just an Emal update, I get an error message :
"errors": [
{
"title": "Save failed with the following error: You can't save a user account without selecting at least one user group.",
"code": 400
}
]
This means any PATCH to a user needs to GET their group memberships and then rewrite them, which seems a bit illogical if no change to groups is needed or desired.

[alikon]

make sense, pull request are wellcome

p.s
can you please mark a successfull test #37994 on https://issues.joomla.org/tracker/joomla-cms/37994

[aftertaf]

make sense, pull request are wellcome

p.s can you please mark a successfull test #37994 on https://issues.joomla.org/tracker/joomla-cms/37994

Done.. (still learning what needs doing when , etc... thanks for your patience :) )

[aftertaf]

make sense, pull request are wellcome

could you point me towards the file that would need changing ? i could try to change it if I knew which one, ( least I can do :) )

[alikon]

as a starting point i would debug nearby https://github.com/joomla/joomla-cms/blob/4.1-dev/administrator/components/com_users/src/Model/UserModel.php#L254-L259

[aftertaf]

Thanks! Will look at this tonight!

…

________________________________ From: Nicola Galgano ***@***.***> Sent: Monday, June 6, 2022 3:31:45 PM To: joomla/joomla-cms ***@***.***> Cc: Aftertaf ***@***.***>; Author ***@***.***> Subject: Re: [joomla/joomla-cms] [4.1.4] (and [4.2.0dev3]) - Webservices PATCH to update a user fails with status 400 (Issue #37991) as a starting point i would debug nearby https://github.com/joomla/joomla-cms/blob/4.1-dev/administrator/components/com_users/src/Model/UserModel.php#L254-L259 — Reply to this email directly, view it on GitHub<#37991 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AWW6E3BFEH3WTAP5IMIXTN3VNX4UDANCNFSM5X5F3L7Q>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[aftertaf]

ok. I've had a look and tried to make a quick fix/workaround.....
disclaimer, I ain't a developer :)
I have tried but got myself a bit tangled...

What's the 'right' way to ask someone else to look at this, and make it possible, when doing an API PATCH call to the USERS API, to not need to send group-related information ?

[alikon]

open a new issue