Hotfix authapi

[joshuaboniface]

Changes
Add a MethodNotAllowedException to the HTTP handler. Checks the /Users/AuthenticateByName API call to see if a plaintext password has been provided; if not, return the MethodNotAllowedException to the client.

Issues
Addresses #1222

[joshuaboniface]

CC @Tolriq I think this is what you're hoping for with the API return!

[anthonylavado]

Just check with the other C# folk to see if my comment is valid or not. I haven’t tested this, but it looks okay to me.

[anthonylavado]

I’m no genius, but I think you want a string.IsNullOrEmpty(request.Pw) here.

[cvium]

Yes

[anthonylavado]

So here’s the suggestion:

Suggested change

	if (request.Pw == "")
	if (string.IsNullOrEmpty(request.Pw))

[Tolriq]

The 405 error yes but I'm not sure the check is OK as Jellyfin allows to have users without password. (The default created account is the server name without one for example)

And since it seems pre hashed password have priority later in code, proper check is probablyif (!string.IsNullOrEmpty(request.Password)) (Should be enough since it seems you do not use the PasswordMd5 in the later call).

[joshuaboniface]

@Tolriq @cvium @anthonylavado So I guess this construct would be the best of both?

if (!string.IsNullOrEmpty(request.Password) || string.IsNullOrEmpty(request.Pw))

[Tolriq]

Well no you still return the error for empty password.

Proper would be if (!string.IsNullOrEmpty(request.Password) && string.IsNullOrEmpty(request.Pw)) but then you'd need to update line 390
Password = request.Password, by Password = null, to properly ignore when both are provided.

[anthonylavado]

LGTM

[sparky8251]

Looks good to me.

[Tolriq]

Thanks for all the changes. Do you plan to make an RC3? Do you have an approximative date for official 10.3 release?

[joshuaboniface]

@Tolriq Happy to help keep Yatse compatible ;-) I'm hoping for final release in the next day or so, no RC3 unless a showstopper comes up.

[Tolriq]

Hum ok :( Bad timing so as I've just released without support for auto fixing connexion.

Will see if there's too much support to push a quick fix release.

[joshuaboniface]

Ah darn, yea, will probably release tonight. Keep me updated either way, and I can adjust release notes accordingly.

[joshuaboniface]

@Tolriq What version would you target for the updated changes? Just writing a note in the release notes for Yatse users to avoid upgrading until your release is out.

[Tolriq]

My release is out and support Jellyfin 10.3 if they add it manually.

The issue is about users that already have Jellyfin configured, it's currently seen as an Emby device and so won't be automatically migrated until I handle the error 405 case.

You can just add a note that they may need to remove / add again the host as Jellyfin to ensure.

[joshuaboniface]

Sounds good to me, thanks @Tolriq!