mirror of
https://github.com/jellyfin/jellyfin.git
synced 2026-03-01 11:20:59 +03:00
Passwordless user authentication fails when using form encoded request #633
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @thornbill on GitHub (Apr 24, 2019).
Describe the bug
The authenticatebyname API endpoint returns an error when trying to login as a user without a password when using a request that is form encoded.
To Reproduce
Use
curlto issue an authentication request for a user account without a password.Receive the following error message
Additionally if the
passwordorpasswordMd5values are blank the following error is returned.Expected behavior
The user should successfully authenticate and a user object should be returned.
Logs
This does not generate any errors in the logs.
Screenshots
N/A
System (please complete the following information):
Additional context
This is affecting the Android TV app, refs https://github.com/jellyfin/jellyfin-androidtv/issues/90
@bugfixin commented on GitHub (Apr 25, 2019):
https://github.com/jellyfin/jellyfin/blob/master/Emby.Server.Implementations/Services/StringMapTypeDeserializer.cs on line 74 the isnullorempty check effectively converts empty fields to null fields, resulting in the null Pw later on. application/json requests effectively bypass this (the instance is already populated via a previous deserializer). We could replace that with checking directly if the propertyTextValue is null on that line 74, or we could change the AuthenticateLocalUser function in https://github.com/jellyfin/jellyfin/blob/master/Emby.Server.Implementations/Library/UserManager.cs (or some step earlier) to explicitly set hashedpassword or password to an empty string if they are null.