SONAR-8716 fix check of permissions in api/users/search

2 files changed, 7 insertions, 9 deletions

diff --git a/server/sonar-server/src/main/java/org/sonar/server/user/ws/UserJsonWriter.java b/server/sonar-server/src/main/java/org/sonar/server/user/ws/UserJsonWriter.java
index 990d4db28ff..ea4458513a9 100644
--- a/server/sonar-server/src/main/java/org/sonar/server/user/ws/UserJsonWriter.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/user/ws/UserJsonWriter.java
@@ -25,7 +25,6 @@ import java.util.Collections;
 import java.util.Set;
 import javax.annotation.Nullable;
 import org.sonar.api.utils.text.JsonWriter;
-import org.sonar.core.permission.GlobalPermissions;
 import org.sonar.db.user.UserDto;
 import org.sonar.server.user.UserSession;
 
@@ -94,7 +93,7 @@ public class UserJsonWriter {
   }
 
   private void writeGroupsIfNeeded(JsonWriter json, Collection<String> groups, @Nullable Collection<String> fields) {
-    if (isFieldNeeded(FIELD_GROUPS, fields) && userSession.hasPermission(GlobalPermissions.SYSTEM_ADMIN)) {
+    if (isFieldNeeded(FIELD_GROUPS, fields) && userSession.isRoot()) {
       json.name(FIELD_GROUPS).beginArray();
       for (String groupName : groups) {
         json.value(groupName);
diff --git a/server/sonar-server/src/test/java/org/sonar/server/user/ws/SearchActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/user/ws/SearchActionTest.java
index b1ce2579bbb..9a32918b688 100644
--- a/server/sonar-server/src/test/java/org/sonar/server/user/ws/SearchActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/user/ws/SearchActionTest.java
@@ -26,7 +26,6 @@ import org.junit.Test;
 import org.sonar.api.config.MapSettings;
 import org.sonar.api.server.ws.WebService.Param;
 import org.sonar.api.utils.System2;
-import org.sonar.core.permission.GlobalPermissions;
 import org.sonar.db.DbClient;
 import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
@@ -94,7 +93,7 @@ public class SearchActionTest {
     dbClient.userTokenDao().insert(dbSession, newUserToken().setLogin(fmallet.getLogin()));
     db.commit();
     userIndexer.index();
-    loginAsAdmin();
+    loginAsRoot();
 
     String response = ws.newGetRequest("api/users", "search").execute().outputAsString();
 
@@ -177,7 +176,7 @@ public class SearchActionTest {
       .doesNotContain("scmAccounts")
       .doesNotContain("groups");
 
-    loginAsAdmin();
+    loginAsRoot();
 
     assertThat(ws.newGetRequest("api/users", "search").execute().outputAsString())
       .contains("login")
@@ -196,7 +195,7 @@ public class SearchActionTest {
 
   @Test
   public void search_with_groups() throws Exception {
-    loginAsAdmin();
+    loginAsRoot();
     List<UserDto> users = injectUsers(1);
 
     GroupDto group1 = dbClient.groupDao().insert(dbSession, newGroupDto().setName("sonar-users"));
@@ -260,12 +259,12 @@ public class SearchActionTest {
     return userDtos;
   }
 
-  private void loginAsAdmin() {
-    userSession.logIn("admin").setGlobalPermissions(GlobalPermissions.SYSTEM_ADMIN);
+  private void loginAsRoot() {
+    userSession.logIn().setRoot();
   }
 
   private void loginAsSimpleUser() {
-    userSession.logIn("user");
+    userSession.logIn();
   }
 
 }