Rest API - DELETE /core/members/{id}/secgroup/{groupId} issue

[NexusMods]

Hi,

We have an issue with the delete secondary group rest API endpoint

The code does not appear to check if the found group key is false before calling unset, which results in the first secondary group being removed (As PHP is casting false to 0)

We are currently working around this by checking if the $key is false before calling unset.
 

$secondaryGroups = array_filter( explode( ',', $member->mgroup_others ) );
$key = array_search( $group->g_id, $secondaryGroups );
if (false !== $key) {
  unset($secondaryGroups[$key]);
}

e.g:
member 1's secondary groups are "5,6,7"
call DELETE /core/members/1/secgroup/2
member 1's groups are now 6,7 and should still be "5,6,7"

[Jim M]

Thank you for bringing this issue to our attention! I can confirm this should be further reviewed and I have logged an internal bug report for our development team to investigate and address as necessary, in a future maintenance release.

 

[Marc Stridgen]

This issue has been resolved in the recently released 4.7.15 version. Please update your site if you are still experiencing the issue, and let us know if you see any reoccurrence.