Content
View differences
Updated by Judith Roth 10 days ago
### Steps to reproduce
1. Navigate to "Administration -> Users and permissions -> Groups -> Partial Rights"
2. Choose Tab "Global roles"
3. Click on "Add"
### What is the buggy behavior?
NoMethodError
### What is the expected behavior?
Working Code :)
###
### **Logs**
```text
web | Group Load (0.5ms) SELECT "users"."id", "users"."login", "users"."firstname", "users"."lastname", "users"."mail", "users"."admin", "users"."status", "users"."last_login_on", "users"."language", "users"."ldap_auth_source_id", "users"."created_at", "users"."updated_at", "users"."type", "users"."first_login", "users"."force_password_change", "users"."failed_login_count", "users"."last_failed_login_on", "users"."consented_at", "users"."webauthn_id" FROM "users" WHERE "users"."type" = $1 AND "users"."status" != $2 AND "users"."id" = $3 LIMIT $4 [["type", "Group"], ["status", 5], ["id", 11], ["LIMIT", 1]]
web | ↳ app/controllers/groups_controller.rb:153:in 'GroupsController#find_group'
web | Unpermitted parameters: :authenticity_token, :button, :id. Context: { controller: GroupsController, action: create_memberships, request: #<ActionDispatch::Request:0x00007d9f9a3e99c0>, params: {"authenticity_token" => "[FILTERED]", "button" => "", "controller" => "groups", "action" => "create_memberships", "id" => "11"} }
web | Completed 500 Internal Server Error in 11ms (ActiveRecord: 2.5ms (4 queries, 0 cached) | GC: 0.5ms)
web |
web |
web | method=POST path=/admin/groups/11/memberships format=turbo_stream controller=GroupsController action=create_memberships status=500 allocations=3582 duration=10.88 view=0.00 db=2.53 unpermitted_params=["authenticity_token", "button", "id"] user=4
web |
web | NoMethodError (undefined method 'merge' for nil):
web |
web | app/controllers/groups_controller.rb:119:in 'GroupsController#create_memberships'
web | Started GET "/api/v3/time_entries?filters=%5B%7B%22ongoing%22%3A%7B%22operator%22%3A%22%3D%22%2C%22values%22%3A%5B%22t%22%5D%7D%7D%5D" for ::1 at 2026-08-14 10:42:46 +0200
web | Setting Maximum (0.5ms) SELECT MAX("settings"."updated_at") FROM "settings"
web | ↳ app/models/setting.rb:280:in 'Setting.settings_updated_at'
web | Setting Pluck (0.3ms) SELECT "settings"."name", "settings"."value" FROM "settings"
web | ↳ app/models/setting.rb:268:in 'block (2 levels) in Setting.cached_settings'
web | User Load (0.7ms) SELECT "users"."id", "users"."login", "users"."firstname", "users"."lastname", "users"."mail", "users"."admin", "users"."status", "users"."last_login_on", "users"."language", "users"."ldap_auth_source_id", "users"."created_at", "users"."updated_at", "users"."type", "users"."first_login", "users"."force_password_change", "users"."failed_login_count", "users"."last_failed_login_on", "users"."consented_at", "users"."webauthn_id" FROM "users" WHERE "users"."type" IN ($1, $2, $3, $4, $5) AND "users"."status" != $6 AND "users"."id" = $7 LIMIT $8 [["type", "User"], ["type", "DeletedUser"], ["type", "ServiceAccount"], ["type", "AnonymousUser"], ["type", "SystemUser"], ["status", 5], ["id", 4], ["LIMIT", 1]]
web | ↳ lib_static/open_project/authentication/strategies/warden/session.rb:60:in 'OpenProject::Authentication::Strategies::Warden::Session#authenticate!'
```
### Screenrecording
[Screencast\_from\_2026-08-14\_10-48-38.mp4](https://community.openproject.org/attachments/923749/Screencast_from_2026-08-14_10-48-38.mp4)
###
<br>
**OpenProject version**
Unreleased / dev (b3262b08aa1c9426c91d99ff558f5e1dbe5ce5f6) (b227d10d612502d18e3942fff262554bf5ff34d3)
<br>
1. Navigate to "Administration -> Users and permissions -> Groups -> Partial Rights"
2. Choose Tab "Global roles"
3. Click on "Add"
### What is the buggy behavior?
NoMethodError
### What is the expected behavior?
Working Code :)
###
### **Logs**
```text
web | Group Load (0.5ms) SELECT "users"."id", "users"."login", "users"."firstname", "users"."lastname", "users"."mail", "users"."admin", "users"."status", "users"."last_login_on", "users"."language", "users"."ldap_auth_source_id", "users"."created_at", "users"."updated_at", "users"."type", "users"."first_login", "users"."force_password_change", "users"."failed_login_count", "users"."last_failed_login_on", "users"."consented_at", "users"."webauthn_id" FROM "users" WHERE "users"."type" = $1 AND "users"."status" != $2 AND "users"."id" = $3 LIMIT $4 [["type", "Group"], ["status", 5], ["id", 11], ["LIMIT", 1]]
web | ↳ app/controllers/groups_controller.rb:153:in 'GroupsController#find_group'
web | Unpermitted parameters: :authenticity_token, :button, :id. Context: { controller: GroupsController, action: create_memberships, request: #<ActionDispatch::Request:0x00007d9f9a3e99c0>, params: {"authenticity_token" => "[FILTERED]", "button" => "", "controller" => "groups", "action" => "create_memberships", "id" => "11"} }
web | Completed 500 Internal Server Error in 11ms (ActiveRecord: 2.5ms (4 queries, 0 cached) | GC: 0.5ms)
web |
web |
web | method=POST path=/admin/groups/11/memberships format=turbo_stream controller=GroupsController action=create_memberships status=500 allocations=3582 duration=10.88 view=0.00 db=2.53 unpermitted_params=["authenticity_token", "button", "id"] user=4
web |
web | NoMethodError (undefined method 'merge' for nil):
web |
web | app/controllers/groups_controller.rb:119:in 'GroupsController#create_memberships'
web | Started GET "/api/v3/time_entries?filters=%5B%7B%22ongoing%22%3A%7B%22operator%22%3A%22%3D%22%2C%22values%22%3A%5B%22t%22%5D%7D%7D%5D" for ::1 at 2026-08-14 10:42:46 +0200
web | Setting Maximum (0.5ms) SELECT MAX("settings"."updated_at") FROM "settings"
web | ↳ app/models/setting.rb:280:in 'Setting.settings_updated_at'
web | Setting Pluck (0.3ms) SELECT "settings"."name", "settings"."value" FROM "settings"
web | ↳ app/models/setting.rb:268:in 'block (2 levels) in Setting.cached_settings'
web | User Load (0.7ms) SELECT "users"."id", "users"."login", "users"."firstname", "users"."lastname", "users"."mail", "users"."admin", "users"."status", "users"."last_login_on", "users"."language", "users"."ldap_auth_source_id", "users"."created_at", "users"."updated_at", "users"."type", "users"."first_login", "users"."force_password_change", "users"."failed_login_count", "users"."last_failed_login_on", "users"."consented_at", "users"."webauthn_id" FROM "users" WHERE "users"."type" IN ($1, $2, $3, $4, $5) AND "users"."status" != $6 AND "users"."id" = $7 LIMIT $8 [["type", "User"], ["type", "DeletedUser"], ["type", "ServiceAccount"], ["type", "AnonymousUser"], ["type", "SystemUser"], ["status", 5], ["id", 4], ["LIMIT", 1]]
web | ↳ lib_static/open_project/authentication/strategies/warden/session.rb:60:in 'OpenProject::Authentication::Strategies::Warden::Session#authenticate!'
```
### Screenrecording
[Screencast\_from\_2026-08-14\_10-48-38.mp4](https://community.openproject.org/attachments/923749/Screencast_from_2026-08-14_10-48-38.mp4)
###
<br>
**OpenProject version**
Unreleased / dev (b3262b08aa1c9426c91d99ff558f5e1dbe5ce5f6)
<br>