Vote #76136
完了Creating new issues with invalid project_id should return 422 instead of 403 error
0%
説明
Hi,
The following REST request worked fine in Redmine 2.6.0:
$ curl -v -H "Content-Type: application/xml" -X POST --data "@test.xml" -u test:testpass https://example.com/issues.xml
test.xml
test test_project 6 test
Since upgrading to Redmine 3.0.0 the server responds with a HTTP 403 Forbidden.
I don't change user's role or other permissions.
journals
As you can see on the "API documentation":/projects/redmine/wiki/Rest_Issues#Creating-an-issue, the project_id attribute must be the numeric id of the project.
--------------------------------------------------------------------------------
That is actually not true. This has always worked. I am also getting 403's after upgrading. As your linked API documentation states:
<pre>
project_id: get issues from the project with the given id, where id is either project id or project identifier.
</pre>
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
same here. I installed Redmine 3.0.0 to our test server and tried running Redmine Java API tests against it:
> com.taskadapter.redmineapi.NotAuthorizedException: Forbidden. Please check the user has proper permissions.
this worked fine with all previous Redmine versions.
--------------------------------------------------------------------------------
was "project key" requirement changed to "project numeric ID" somewhere between 2.6.2 and 3.0.0 releases? if yes, can we document this on REST Issue page in Wiki?
--------------------------------------------------------------------------------
and one other thing: if project ID cannot be parsed then there should be a proper error returned to clients, not "forbidden" - that one is totally misleading.
--------------------------------------------------------------------------------
Aron Rotteveel wrote:
> That is actually not true. This has always worked. I am also getting 403's after upgrading. As your linked API documentation states:
Project identifier can be used as a filter and even if it used to work, it was never supposed to be used as a project_id value when creating an issue, as you can see in the api tests: source:/trunk/test/integration/api_test/issues_test.rb or in the [[Rest_api_with_curl|curl example]]. It's consistent with other API endpoints that take a project id (project.parent_id and time_entry.project_id) and consistent with API responses. The API doc should be updated.
> and one other thing: if project ID cannot be parsed then there should be a proper error returned to clients, not "forbidden" - that one is totally misleading.
A 422 response would be a better option indeed.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Note: the documentation still states
<pre>project_id: get issues from the project with the given id, where id is either project id or project identifier</pre>
which is quite confusing.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Alexander Muthmann wrote:
> Note: the documentation still states
> [...]
> which is quite confusing.
Thanks for pointing it out. I have "fixed":http://www.redmine.org/projects/redmine/wiki/Rest_Issues/diff?utf8=%E2%9C%93&version=55&version_from=54&commit=View+differences the document.
bq. project_id: get issues from the project with the given id (a numeric value, not a project identifier).
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
related_issues
relates,Closed,1003,Allow "New Issue" from anywhere
relates,Closed,23766,API : creating issues with project identifier no longer possible
duplicates,Closed,20119,REST API: setting project_id in issue not accepted in Redmine 3.0.3