From 38145a917eaa6ed9d45cf4f1d1765c34d25241f7 Mon Sep 17 00:00:00 2001 From: Stefan Date: Mon, 14 Sep 2026 14:51:44 +0200 Subject: [PATCH] Fix login accepting wrong credentials (empty user signed in anyway) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit fis_admin_getUserAccount always inserted a result row, even when no matching user was found, so fis_admin_authenticate never truly returned "no result" on wrong credentials — the login handler then signed the caller in with an empty useraccount_id. The authenticated shell rendered (IsAuthenticated only checks the claim exists), while every data endpoint 401'd (FuchsUserIdentity.IsAuthenticated also checks the id is non-empty), producing an empty portal. Also treat an empty useraccount_id in HandleLogin as a failed login (defense in depth) and fix a column-name mismatch (auth vs authorization) that was silently zeroing the authorization level. Co-Authored-By: Claude Sonnet 5 --- Fuchs/Controllers/IntranetController.cs | 6 ++-- .../Functions/fis_admin_getUserAccount.sql | 29 ++++++++++--------- 2 files changed, 19 insertions(+), 16 deletions(-) diff --git a/Fuchs/Controllers/IntranetController.cs b/Fuchs/Controllers/IntranetController.cs index 16b594c..8149f6c 100644 --- a/Fuchs/Controllers/IntranetController.cs +++ b/Fuchs/Controllers/IntranetController.cs @@ -249,16 +249,16 @@ public partial class IntranetController : Microsoft.AspNetCore.Mvc.Controller _logger.LogDebug("HandleLogin attempt for email={Email} ip={IP}", email, HttpContext.Connection.RemoteIpAddress); var row = await _intranet.AuthenticateAsync(email, password); - if (row == null) + string userId = row?.nz("useraccount_id") ?? ""; + if (row == null || string.IsNullOrEmpty(userId)) { _logger.LogWarning("Login failed for email={Email} ip={IP}", email, HttpContext.Connection.RemoteIpAddress); return Unauthorized401(); } - string userId = row.nz("useraccount_id"); string userEmail = row.nz("email"); - int auth = int.TryParse(row.nz("authorization"), out var a) ? a : 0; + int auth = int.TryParse(row.nz("auth"), out var a) ? a : 0; var identity = FuchsUserIdentity.BuildIdentity(userId, userEmail, auth, Fuchs_intranet.AuthScheme); var principal = new System.Security.Claims.ClaimsPrincipal(identity); diff --git a/Fuchs_Database/dbo/Functions/fis_admin_getUserAccount.sql b/Fuchs_Database/dbo/Functions/fis_admin_getUserAccount.sql index b409a59..9221219 100644 --- a/Fuchs_Database/dbo/Functions/fis_admin_getUserAccount.sql +++ b/Fuchs_Database/dbo/Functions/fis_admin_getUserAccount.sql @@ -36,19 +36,22 @@ BEGIN (SELECT ',' + [value] as [text()] FROM [fis_useraccounts_settings] WHERE [useraccount_id] = @useraccount_id and [key] = 'intranet_function' FOR XML PATH(''), TYPE).value('.','nvarchar(max)') , 1,1,''); - INSERT INTO @RET - VALUES( - @useraccount_id - ,IIF(@useraccount_id is null, -1, @auth) - ,IIF(@useraccount_id is null, null, @name) - ,IIF(@useraccount_id is null, null, @firstname) - ,IIF(@useraccount_id is null, null, @email) - ,IIF(@useraccount_id is null, null, @mobile) - ,IIF(@useraccount_id is null, null, @functions) - ,IIF(@useraccount_id is null, null, @language) - ,IIF(@useraccount_id is null, null, @fullname) - ,IIF(@useraccount_id is null, null, @fullname_rev) - ); + IF @useraccount_id IS NOT NULL + BEGIN + INSERT INTO @RET + VALUES( + @useraccount_id + ,@auth + ,@name + ,@firstname + ,@email + ,@mobile + ,@functions + ,@language + ,@fullname + ,@fullname_rev + ); + END RETURN;