Fix `updated_at` doesn't apply to `state_event` updates of issues via API

1 files changed, 7 insertions, 3 deletions

diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 999a9cb5a82..000c00ea9f9 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -230,9 +230,13 @@ module API
         issue = user_project.issues.find_by!(iid: params.delete(:issue_iid))
         authorize! :update_issue, issue
 
-        # Setting created_at time only allowed for admins and project/group owners
-        unless current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner)
-          params.delete(:updated_at)
+        # Setting updated_at only allowed for admins and owners as well
+        if params[:updated_at].present?
+          if current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner)
+            issue.system_note_timestamp = params[:updated_at]
+          else
+            params.delete(:updated_at)
+          end
         end
 
         update_params = declared_params(include_missing: false).merge(request: request, api: true)