StefanandClaude Sonnet 5
38145a917e
fis_admin_getUserAccount always inserted a result row, even when no matching user was found, so fis_admin_authenticate never truly returned "no result" on wrong credentials — the login handler then signed the caller in with an empty useraccount_id. The authenticated shell rendered (IsAuthenticated only checks the claim exists), while every data endpoint 401'd (FuchsUserIdentity.IsAuthenticated also checks the id is non-empty), producing an empty portal. Also treat an empty useraccount_id in HandleLogin as a failed login (defense in depth) and fix a column-name mismatch (auth vs authorization) that was silently zeroing the authorization level. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
58 lines
2.4 KiB
Transact-SQL
58 lines
2.4 KiB
Transact-SQL
|
|
|
|
-- =============================================
|
|
-- Author: <Author,,Name>
|
|
-- Create date: <Create Date, ,>
|
|
-- Description: <Description, ,>
|
|
-- =============================================
|
|
CREATE FUNCTION [dbo].[fis_admin_getUserAccount]
|
|
(
|
|
@useraccount_id varchar(5)
|
|
)
|
|
RETURNS @RET TABLE ( [useraccount_id] varchar(5), [auth] smallint, [name] nvarchar(100) null, [firstname] nvarchar(100) null, [email] varchar(255) NULL, [mobile] varchar(50) null, [functions] varchar(1000), [language] varchar(2), [fullname] nvarchar(255) null, [fullname_rev] nvarchar(255) null)
|
|
AS
|
|
BEGIN
|
|
DECLARE @auth smallint = -1;
|
|
DECLARE @email varchar(255), @name nvarchar(100), @firstname nvarchar(100), @mobile varchar(50), @functions varchar(1000) = '', @title varchar(50), @gender varchar(1), @password varchar(5), @language varchar(2), @fullname nvarchar(255), @fullname_rev nvarchar(255);
|
|
|
|
SELECT TOP(1) @useraccount_id = [useraccount_id]
|
|
,@auth = CASE WHEN [useraccount_id] is null THEN -1 ELSE 1 END
|
|
,@name = CAST(DECRYPTBYKEY(ua.[name_enc]) as nvarchar(100))
|
|
,@firstname = CAST(DECRYPTBYKEY(ua.[firstname_enc]) as nvarchar(100))
|
|
,@title = CAST(DECRYPTBYKEY(ua.[title_enc]) as varchar(50))
|
|
,@gender = CAST(DECRYPTBYKEY(ua.[gender_enc]) as varchar(1))
|
|
--,@password = DECRYPTBYKEY(ua.[password_enc])
|
|
,@email = CAST(DECRYPTBYKEY(ua.[email_enc]) as varchar(255))
|
|
,@mobile = CAST(DECRYPTBYKEY(ua.[mobile_enc]) as varchar(50))
|
|
,@language = ua.[language]
|
|
,@fullname = [dbo].[fis_admin_getUserName](ua.[name_enc], ua.[firstname_enc], ua.[title_enc])
|
|
,@fullname_rev = [dbo].[fis_admin_getUserName_rev](ua.[name_enc], ua.[firstname_enc], ua.[title_enc])
|
|
FROM [dbo].[fis_useraccounts] as ua
|
|
WHERE ua.[DateDeleted] is null AND ua.[DateDisabled] is null
|
|
AND ua.[useraccount_id] = @useraccount_id;
|
|
|
|
SET @auth = ISNULL(TRY_CAST((SELECT TOP(1) [value] FROM [fis_useraccounts_settings] WHERE [useraccount_id] = @useraccount_id and [key] = 'intranet_admin') as smallint), @auth);
|
|
SET @functions = STUFF(
|
|
(SELECT ',' + [value] as [text()] FROM [fis_useraccounts_settings] WHERE [useraccount_id] = @useraccount_id and [key] = 'intranet_function' FOR XML PATH(''), TYPE).value('.','nvarchar(max)')
|
|
, 1,1,'');
|
|
|
|
IF @useraccount_id IS NOT NULL
|
|
BEGIN
|
|
INSERT INTO @RET
|
|
VALUES(
|
|
@useraccount_id
|
|
,@auth
|
|
,@name
|
|
,@firstname
|
|
,@email
|
|
,@mobile
|
|
,@functions
|
|
,@language
|
|
,@fullname
|
|
,@fullname_rev
|
|
);
|
|
END
|
|
|
|
RETURN;
|
|
|
|
END |