mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-18 07:30:29 +00:00
2d300cebed
Four independent bugs found while reviewing the HTTP layer:
initial_setup.go: createInitialAdminUser assigned the users.Put error to a
shadowed err, so the outer err (always nil by then, since a CountAll failure
panics) was returned instead. A failure to create the admin user was reported
as success, and initialSetup went on to commit the "setup complete" property
in the same transaction — so no admin user existed and initial setup was
skipped on every later boot.
auth.go: createAdminUser logged the Put error but returned nil, so createAdmin
fell through to doLogin and answered 401 "Invalid username or password"
instead of surfacing the real failure. It also logged the whole model.User,
which puts the new admin's password in the log in clear text; every other call
site logs user.UserName.
native_api.go: writeDeleteManyResponse did not return after http.Error when
marshaling failed, then wrote a nil body over the 500. It also built the
single-id body by hand with html.EscapeString, which does not escape
backslashes, so an id ending in one produced `{"id":"a\"}` — invalid JSON.
Both shapes now go through json.Marshal. A failed Write is now logged rather
than answered with http.Error, which could not work once the body had started.
handle_shares.go: handleM3U set Content-Type after WriteHeader, so it was
never sent and shared playlists were served with a sniffed type.
Signed-off-by: zapisanchez <zapisanchez@gmail.com>
58 lines
1.7 KiB
Go
58 lines
1.7 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"github.com/navidrome/navidrome/model"
|
|
"github.com/navidrome/navidrome/tests"
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
)
|
|
|
|
// failingPutUserRepo counts users normally but fails to store them, to exercise the
|
|
// error path of the initial user creation.
|
|
type failingPutUserRepo struct {
|
|
model.UserRepository
|
|
err error
|
|
}
|
|
|
|
func (r *failingPutUserRepo) Put(*model.User) error { return r.err }
|
|
|
|
func dsWithFailingPut(err error) model.DataStore {
|
|
return &tests.MockDataStore{MockedUser: &failingPutUserRepo{UserRepository: tests.CreateMockUserRepo(), err: err}}
|
|
}
|
|
|
|
var _ = Describe("initial_setup", func() {
|
|
var ds model.DataStore
|
|
|
|
BeforeEach(func() {
|
|
ds = &tests.MockDataStore{}
|
|
})
|
|
|
|
Describe("createInitialAdminUser", func() {
|
|
It("creates a new admin user with specified password if User table is empty", func() {
|
|
Expect(createInitialAdminUser(ds, "pass123")).To(BeNil())
|
|
ur := ds.User(context.TODO())
|
|
admin, err := ur.FindByUsername("admin")
|
|
Expect(err).To(BeNil())
|
|
Expect(admin.Password).To(Equal("pass123"))
|
|
})
|
|
|
|
It("does not create a new admin user if User table is not empty", func() {
|
|
Expect(createInitialAdminUser(ds, "first")).To(BeNil())
|
|
ur := ds.User(context.TODO())
|
|
Expect(ur.CountAll()).To(Equal(int64(1)))
|
|
Expect(createInitialAdminUser(ds, "second")).To(BeNil())
|
|
Expect(ur.CountAll()).To(Equal(int64(1)))
|
|
})
|
|
|
|
// The error was assigned to a shadowed err and dropped, so the caller saw
|
|
// success and went on to commit the "setup complete" flag.
|
|
It("returns the error when the user cannot be stored", func() {
|
|
boom := errors.New("db is down")
|
|
Expect(createInitialAdminUser(dsWithFailingPut(boom), "pass123")).To(MatchError(boom))
|
|
})
|
|
})
|
|
})
|