Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix FirstTimeSetupHandler not failing on invalid user if not in setup mode #9747

Merged
merged 3 commits into from
May 10, 2023
Merged

Fix FirstTimeSetupHandler not failing on invalid user if not in setup mode #9747

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c0d2070
Fix FirstTimeSetupHandler not failing on unauthed user if not in setup
Shadowghost May 9, 2023
bea865d
Add 401Unauthorized status comments to SystemController
Shadowghost May 9, 2023
0f7fd40
Apply review suggestions
Shadowghost May 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions Jellyfin.Api/Auth/FirstTimeSetupPolicy/FirstTimeSetupHandler.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,15 @@ protected override Task HandleRequirementAsync(AuthorizationHandlerContext conte
return Task.CompletedTask;
}

if (requirement.RequireAdmin && !context.User.IsInRole(UserRoles.Administrator))
var contextUser = context.User;
if (requirement.RequireAdmin && !contextUser.IsInRole(UserRoles.Administrator))
{
context.Fail();
return Task.CompletedTask;
}

var userId = contextUser.GetUserId();
if (userId.Equals(default))
crobibero marked this conversation as resolved.
Show resolved Hide resolved
{
context.Fail();
return Task.CompletedTask;
Expand All @@ -50,7 +58,7 @@ protected override Task HandleRequirementAsync(AuthorizationHandlerContext conte
return Task.CompletedTask;
}

var user = _userManager.GetUserById(context.User.GetUserId());
var user = _userManager.GetUserById(userId);
if (user is null)
{
throw new ResourceNotFoundException();
Expand Down
12 changes: 12 additions & 0 deletions Jellyfin.Api/Controllers/SystemController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,10 +59,12 @@ public class SystemController : BaseJellyfinApiController
/// Gets information about the server.
/// </summary>
/// <response code="200">Information retrieved.</response>
/// <response code="403">User does not have permission to retrieve information.</response>
/// <returns>A <see cref="SystemInfo"/> with info about the system.</returns>
[HttpGet("Info")]
[Authorize(Policy = Policies.FirstTimeSetupOrIgnoreParentalControl)]
[ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status401Unauthorized)]
crobibero marked this conversation as resolved.
Show resolved Hide resolved
public ActionResult<SystemInfo> GetSystemInfo()
{
return _appHost.GetSystemInfo(Request);
Expand Down Expand Up @@ -97,10 +99,12 @@ public ActionResult<string> PingSystem()
/// Restarts the application.
/// </summary>
/// <response code="204">Server restarted.</response>
/// <response code="403">User does not have permission to restart server.</response>
/// <returns>No content. Server restarted.</returns>
[HttpPost("Restart")]
[Authorize(Policy = Policies.LocalAccessOrRequiresElevation)]
[ProducesResponseType(StatusCodes.Status204NoContent)]
[ProducesResponseType(StatusCodes.Status401Unauthorized)]
public ActionResult RestartApplication()
{
Task.Run(async () =>
Expand All @@ -115,10 +119,12 @@ public ActionResult RestartApplication()
/// Shuts down the application.
/// </summary>
/// <response code="204">Server shut down.</response>
/// <response code="403">User does not have permission to shutdown server.</response>
/// <returns>No content. Server shut down.</returns>
[HttpPost("Shutdown")]
[Authorize(Policy = Policies.RequiresElevation)]
[ProducesResponseType(StatusCodes.Status204NoContent)]
[ProducesResponseType(StatusCodes.Status401Unauthorized)]
public ActionResult ShutdownApplication()
{
Task.Run(async () =>
Expand All @@ -133,10 +139,12 @@ public ActionResult ShutdownApplication()
/// Gets a list of available server log files.
/// </summary>
/// <response code="200">Information retrieved.</response>
/// <response code="403">User does not have permission to get server logs.</response>
/// <returns>An array of <see cref="LogFile"/> with the available log files.</returns>
[HttpGet("Logs")]
[Authorize(Policy = Policies.RequiresElevation)]
[ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status401Unauthorized)]
public ActionResult<LogFile[]> GetServerLogs()
{
IEnumerable<FileSystemMetadata> files;
Expand Down Expand Up @@ -170,10 +178,12 @@ public ActionResult<LogFile[]> GetServerLogs()
/// Gets information about the request endpoint.
/// </summary>
/// <response code="200">Information retrieved.</response>
/// <response code="403">User does not have permission to get endpoint information.</response>
/// <returns><see cref="EndPointInfo"/> with information about the endpoint.</returns>
[HttpGet("Endpoint")]
[Authorize]
[ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status401Unauthorized)]
public ActionResult<EndPointInfo> GetEndpointInfo()
{
return new EndPointInfo
Expand All @@ -188,10 +198,12 @@ public ActionResult<EndPointInfo> GetEndpointInfo()
/// </summary>
/// <param name="name">The name of the log file to get.</param>
/// <response code="200">Log file retrieved.</response>
/// <response code="403">User does not have permission to get log files.</response>
/// <returns>The log file.</returns>
[HttpGet("Logs/Log")]
[Authorize(Policy = Policies.RequiresElevation)]
[ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status401Unauthorized)]
[ProducesFile(MediaTypeNames.Text.Plain)]
public ActionResult GetLogFile([FromQuery, Required] string name)
{
Expand Down
Loading