Skip to content

Prevent default overwrite for theme and color ID in user API

What does this MR do?

This MR is similar to !24456 (merged) and fixes the same issue as #202070 (closed), but for the theme_id and color_scheme_id properties within the PUT /api/v4/users/:id API (introduced in 710a192a).

While both theme_id and color_scheme_id properties are marked as optional within the API documentation, if they're not set during a PUT /api/v4/users/:id API call, the theme and color-scheme will fall-back to a hardcoded default value. This is caused by the default: 1 configuration, which will always use 1 for both theme and color-scheme if they're not defined.

By simply removing this configuration, the original configuration (either user configured one or instance default) will be used and the API hence behaves as expected.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Fabio Huser

Merge request reports