Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#46768] - [5.4] Allow PATCH /api/users/{super-user-id}

RTC bug Webservices PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar OctavianC
OctavianC
29 Jan 2026

Pull Request for Issue #46766 .

Summary of Changes

The System - Action Logs plugin loads a form in the onContentPrepareForm event if the following conditions match:

  • The context is com_users.profile or com_users.user - so whenever a com_users form is loaded
  • The user ID is that of a Super User (core.admin permission)
  • The Action Log - Joomla Plugin must be enabled
    This form prevents saving a Super User through an API PATCH request because it contains this field:
<field
	name="actionlogsNotify"
	type="radio"
	label="PLG_SYSTEM_ACTIONLOGS_NOTIFICATIONS"
	layout="joomla.form.field.radio.switcher"
	default="0"
	filter="integer"
	required="true"
	>
	<option value="0">JNO</option>
	<option value="1">JYES</option>
</field>

This field is required and fails validation since it's missing from the request. In my opinion the best way to handle this is to remove the required attribute as it also creates the illusion that the field must be turned on due to the required asterisk next to it (think of agreement mandatory fields).
image

Testing Instructions

  • Look for your own (or another Super User) ID
image
  • Create a PATCH request to that ID eg. https://[joomla-url]/api/index.php/v1/users/581 with a simple payload:
{
    "block": 1
}

If the above results in an error message such as:
Save failed with the following error: You can't save a user account without selecting at least one user group.
Either apply the PR #46750, download the latest nightly since that PR is already merged or adjust your payload to include some groups to speed things up and bypass the error:

{
    "block": 1,
    "groups": [8]
}
  • Make sure that the field can be turned on from the administrator client:
image - And turned off as well: image

Actual result BEFORE applying this Pull Request

{"errors":[{"title":"Field required: Email Notifications"}]}

Expected result AFTER applying this Pull Request

{"errors":[{"title":"Save failed with the following error: You can't block yourself.","code":400}]}

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar OctavianC OctavianC - open - 29 Jan 2026
avatar OctavianC OctavianC - change - 29 Jan 2026
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 29 Jan 2026
Category ⇒ Front End Plugins
avatar exlemor exlemor - test_item - 29 Jan 2026 - Tested successfully
avatar exlemor
exlemor - comment - 29 Jan 2026

I have tested this item ✅ successfully on bcbbc19

I have tested this successfully! Thanks @OctavianC! :)

I got the message: "title": "Save failed with the following error: You can't block yourself.", "code": 400 for my SU user and it worked/blocked for another SU user.

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46768.

avatar Megharaj170804 Megharaj170804 - test_item - 30 Jan 2026 - Tested successfully
avatar Megharaj170804
Megharaj170804 - comment - 30 Jan 2026

I have tested this item ✅ successfully on bcbbc19

I inspected the file plugins/system/actionlogs/forms/actionlogs.xml and confirmed that the required="true" attribute has been removed from the actionlogsNotify field

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46768.

avatar brianteeman
brianteeman - comment - 30 Jan 2026

@Megharaj170804 it is NOT enough to just check the code has changed - you must check that the code change does what it says it will do as written in the test instructions. That INCLUDES using the api to Create a PATCH request

I have removed your test at this time until you have done that

avatar brianteeman brianteeman - alter_testresult - 30 Jan 2026 - Megharah170804: Not tested
avatar brianteeman brianteeman - alter_testresult - 30 Jan 2026 - Megharaj170804: Not tested
avatar Megharaj170804
Megharaj170804 - comment - 30 Jan 2026

I have successfully tested this item ✅ on bcbbc19.
Code Verification

I confirmed that the required="true" attribute has been removed from the
actionlogsNotify field in:

plugins/system/actionlogs/forms/actionlogs.xml

Field Attributes Verified

name="actionlogsNotify"

type="radio"

label="PLG_SYSTEM_ACTIONLOGS_NOTIFICATIONS"

layout="joomla.form.field.radio.switcher"

default="0"

filter="integer"

✅ The required attribute is not present (confirmed removed)

API Testing

Following the provided test instructions, I performed API PATCH requests on
Super User accounts.

Before the patch (expected behavior):

Error returned:

{"errors":[{"title":"Field required: Email Notifications"}]}

After the patch (confirmed behavior):

The required field validation error is resolved

API PATCH requests to /api/v1/users/{super-user-id} proceed successfully

Proper validation errors are returned where applicable (e.g. "You can't
block yourself" when attempting to block the currently authenticated
Super User)

Additional Testing

Verified that the field can still be toggled in the Administrator
interface
(System → Users → Edit Super User)

The misleading required asterisk is no longer displayed in the UI

The default value of "0" (No) is correctly applied when the field is not
provided

avatar richard67
richard67 - comment - 1 Feb 2026

@Megharaj170804 To correctly submit a test result it needs to go to the PR in the issue tracker here https://issues.joomla.org/tracker/joomla-cms/46768 and use the blue "Test this" button to submit a test result, otherwise it is not properly counted. I will set the result for you now, but please remember next time when testing PRs. Thanks in advance, and thanks for testing this one.

avatar richard67 richard67 - alter_testresult - 1 Feb 2026 - Megharaj170804: Tested successfully
avatar richard67 richard67 - change - 1 Feb 2026
Status Pending ⇒ Ready to Commit
Labels Added: bug Webservices PR-5.4-dev
avatar richard67
richard67 - comment - 1 Feb 2026

RTC

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46768.

avatar muhme muhme - change - 3 Feb 2026
Labels Added: RTC
avatar muhme
muhme - comment - 3 Feb 2026

✅ Final test before merge with JBT

  • Seen error 400 'Field required: Email Notifications' and User > User Actions Log Options > Email Notifications is mandatory field before PR
  • Applied PR with Patch Tester
  • Changing only email address via API call for the same user account that owns the API token is possible, also for other user
  • User > User Actions Log Options > Email Notifications is no more marked as mandatory field, it is still possible to enable and disable this field
avatar muhme muhme - change - 3 Feb 2026
Status Ready to Commit ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2026-02-03 15:07:28
Closed_By ⇒ muhme
avatar muhme muhme - close - 3 Feb 2026
avatar muhme muhme - merge - 3 Feb 2026

Add a Comment

Login with GitHub to post a comment