API method get_user can be executed by non-admin users ref #539

docs/api/api.rst

@@ -216,8 +216,9 b' get_user'
 --------
 
 Get's an user by username or user_id, Returns empty result if user is not found.
+If userid param is skipped it is set to id of user who is calling this method.
 This command can be executed only using api_key belonging to user with admin 
-rights.
+rights, or regular users which cannot specify userid parameter.
 
 
 INPUT::
@@ -226,7 +227,7 b' INPUT::'
     api_key : "<api_key>"
     method :  "get_user"
     args :    { 
-                "userid" : "<username or user_id>"
+                "userid" : "<username or user_id Optional(=apiuser)>"
               }
 
 OUTPUT::
@@ -351,14 +352,14 b' INPUT::'
     method :  "update_user"
     args :    {
                 "userid" : "<user_id or username>",
-                "username" :  "<username> = Optional",
-                "email" :     "<useremail> = Optional",
-                "password" :  "<password> = Optional",
-                "firstname" : "<firstname> = Optional",
-                "lastname" :  "<lastname> = Optional",
-                "active" :    "<bool> = Optional",
-                "admin" :     "<bool> = Optional",
-                "ldap_dn" :   "<ldap_dn> = Optional"
+                "username" :  "<username> = Optional(None)",
+                "email" :     "<useremail> = Optional(None)",
+                "password" :  "<password> = Optional(None)",
+                "firstname" : "<firstname> = Optional(None)",
+                "lastname" :  "<lastname> = Optional(None)",
+                "active" :    "<bool> = Optional(None)",
+                "admin" :     "<bool> = Optional(None)",
+                "ldap_dn" :   "<ldap_dn> = Optional(None)"
               }
 
 OUTPUT::

rhodecode/controllers/api/api.py

@@ -222,7 +222,7 b' class ApiController(JSONRPCController):'
             #make sure normal user does not pass userid, he is not allowed to do that
             if not isinstance(userid, Optional):
                 raise JSONRPCError(
-                    'Only RhodeCode admin can specify `userid` params'
+                    'Only RhodeCode admin can specify `userid` param'
                 )
         else:
             return abort(403)
@@ -260,14 +260,21 b' class ApiController(JSONRPCController):'
             user_ips=ips
         )
 
-    @HasPermissionAllDecorator('hg.admin')
-    def get_user(self, apiuser, userid):
+    def get_user(self, apiuser, userid=Optional(OAttr('apiuser'))):
         """"
-        Get a user by username
+        Get a user by username, or userid, if userid is given
 
         :param apiuser:
         :param userid:
         """
+        if HasPermissionAnyApi('hg.admin')(user=apiuser):
+            pass
+        else:
+            if not isinstance(userid, Optional):
+                raise JSONRPCError(
+                    'Only RhodeCode admin can specify `userid` params'
+                )
+            userid = apiuser.user_id
 
         user = get_user_or_error(userid)
         data = user.get_api_data()