Rest API - DELETE /core/members/{id}/secgroup/{groupId} issue

[NexusMods]

Hi,

We have an issue with the delete secondary group rest API endpoint

The code does not appear to check if the found group key is false before calling unset, which results in the first secondary group being removed (As PHP is casting false to 0)

We are currently working around this by checking if the $key is false before calling unset.
 

$secondaryGroups = array_filter( explode( ',', $member->mgroup_others ) );
$key = array_search( $group->g_id, $secondaryGroups );
if (false !== $key) {
  unset($secondaryGroups[$key]);
}

e.g:
member 1's secondary groups are "5,6,7"
call DELETE /core/members/1/secgroup/2
member 1's groups are now 6,7 and should still be "5,6,7"

[Jim M]

Thank you for bringing this issue to our attention! I can confirm this should be further reviewed and I have logged an internal bug report for our development team to investigate and address as necessary, in a future maintenance release.

 

[Marc]

This issue has been resolved in the recently released 4.7.15 version. Please update your site if you are still experiencing the issue, and let us know if you see any reoccurrence.

[Hex Rustafied]

It looks like there's still an issue with this route @Marc Stridgen.

When trying to remove a secondary group that only has one group. The API returns 201 created and never removes the group in question. Which I presume is because the array is deemed empty but in reality does have a role on index 0. 

When issuing a removal on a person with multiple roles, it works fine until there's one role left. Then that one stays. So it can really only be because of a miscalculation of the array's size.

[Jim M]

Thank you. I have added this internally for review.