iDrunK65250
Member
- Affected version
- 2.3
Hello,
When I try to retrieve the information of a specific user (in my case ID 2), I get a missing scope error "user:read".
(GET https://mysuperxenforoforum.com/api/users/2)
After checking my key is valid
I created a second key, this time a "User key" with all the scopes and obtained the same result.
I created a third "User Key" with the "user:read" scope. And this time the request worked.
So the bug is that the api doesn't check whether the key has the "allow_all_scopes" field set to true and therefore forces the use of scopes in all cases.
When I try to retrieve the information of a specific user (in my case ID 2), I get a missing scope error "user:read".
(GET https://mysuperxenforoforum.com/api/users/2)
After checking my key is valid
I created a second key, this time a "User key" with all the scopes and obtained the same result.
I created a third "User Key" with the "user:read" scope. And this time the request worked.
So the bug is that the api doesn't check whether the key has the "allow_all_scopes" field set to true and therefore forces the use of scopes in all cases.
