Update to 3.5.2 and .net core 2.1

3 files changed, 85 insertions, 58 deletions

diff --git a/Emby.Server.Implementations/HttpServer/Security/AuthService.cs b/Emby.Server.Implementations/HttpServer/Security/AuthService.cs
index fadab4482..8f6d042dd 100644
--- a/Emby.Server.Implementations/HttpServer/Security/AuthService.cs
+++ b/Emby.Server.Implementations/HttpServer/Security/AuthService.cs
@@ -9,6 +9,7 @@ using MediaBrowser.Controller.Session;
 using System;
 using System.Linq;
 using MediaBrowser.Model.Services;
+using MediaBrowser.Common.Net;
 
 namespace Emby.Server.Implementations.HttpServer.Security
 {
@@ -16,21 +17,21 @@ namespace Emby.Server.Implementations.HttpServer.Security
     {
         private readonly IServerConfigurationManager _config;
 
-        public AuthService(IUserManager userManager, IAuthorizationContext authorizationContext, IServerConfigurationManager config, IConnectManager connectManager, ISessionManager sessionManager, IDeviceManager deviceManager)
+        public AuthService(IUserManager userManager, IAuthorizationContext authorizationContext, IServerConfigurationManager config, IConnectManager connectManager, ISessionManager sessionManager, INetworkManager networkManager)
         {
             AuthorizationContext = authorizationContext;
             _config = config;
-            DeviceManager = deviceManager;
             SessionManager = sessionManager;
             ConnectManager = connectManager;
             UserManager = userManager;
+            NetworkManager = networkManager;
         }
 
         public IUserManager UserManager { get; private set; }
         public IAuthorizationContext AuthorizationContext { get; private set; }
         public IConnectManager ConnectManager { get; private set; }
         public ISessionManager SessionManager { get; private set; }
-        public IDeviceManager DeviceManager { get; private set; }
+        public INetworkManager NetworkManager { get; private set; }
 
         /// <summary>
         /// Redirect the client to a specific URL if authentication failed.
@@ -38,14 +39,12 @@ namespace Emby.Server.Implementations.HttpServer.Security
         /// </summary>
         public string HtmlRedirect { get; set; }
 
-        public void Authenticate(IRequest request,
-            IAuthenticationAttributes authAttribtues)
+        public void Authenticate(IRequest request, IAuthenticationAttributes authAttribtues)
         {
             ValidateUser(request, authAttribtues);
         }
 
-        private void ValidateUser(IRequest request,
-            IAuthenticationAttributes authAttribtues)
+        private void ValidateUser(IRequest request, IAuthenticationAttributes authAttribtues)
         {
             // This code is executed before the service
             var auth = AuthorizationContext.GetAuthorizationInfo(request);
@@ -60,11 +59,14 @@ namespace Emby.Server.Implementations.HttpServer.Security
                 }
             }
 
-            var user = string.IsNullOrWhiteSpace(auth.UserId)
-                ? null
-                : UserManager.GetUserById(auth.UserId);
+            if (authAttribtues.AllowLocalOnly && !request.IsLocal)
+            {
+                throw new SecurityException("Operation not found.");
+            }
 
-            if (user == null & !string.IsNullOrWhiteSpace(auth.UserId))
+            var user = auth.User;
+
+            if (user == null & !auth.UserId.Equals(Guid.Empty))
             {
                 throw new SecurityException("User with Id " + auth.UserId + " not found");
             }
@@ -83,9 +85,9 @@ namespace Emby.Server.Implementations.HttpServer.Security
                 ValidateRoles(roles, user);
             }
 
-            if (!string.IsNullOrWhiteSpace(auth.DeviceId) &&
-                !string.IsNullOrWhiteSpace(auth.Client) &&
-                !string.IsNullOrWhiteSpace(auth.Device))
+            if (!string.IsNullOrEmpty(auth.DeviceId) &&
+                !string.IsNullOrEmpty(auth.Client) &&
+                !string.IsNullOrEmpty(auth.Device))
             {
                 SessionManager.LogSessionActivity(auth.Client,
                     auth.Version,
@@ -108,6 +110,14 @@ namespace Emby.Server.Implementations.HttpServer.Security
                 };
             }
 
+            if (!user.Policy.EnableRemoteAccess && !NetworkManager.IsInLocalNetwork(request.RemoteIp))
+            {
+                throw new SecurityException("User account has been disabled.")
+                {
+                    SecurityExceptionType = SecurityExceptionType.Unauthenticated
+                };
+            }
+
             if (!user.Policy.IsAdministrator &&
                 !authAttribtues.EscapeParentalControl &&
                 !user.IsParentalScheduleAllowed())
@@ -119,17 +129,6 @@ namespace Emby.Server.Implementations.HttpServer.Security
                     SecurityExceptionType = SecurityExceptionType.ParentalControl
                 };
             }
-
-            if (!string.IsNullOrWhiteSpace(auth.DeviceId))
-            {
-                if (!DeviceManager.CanAccessDevice(user.Id.ToString("N"), auth.DeviceId))
-                {
-                    throw new SecurityException("User is not allowed access from this device.")
-                    {
-                        SecurityExceptionType = SecurityExceptionType.ParentalControl
-                    };
-                }
-            }
         }
 
         private bool IsExemptFromAuthenticationToken(AuthorizationInfo auth, IAuthenticationAttributes authAttribtues, IRequest request)
@@ -143,6 +142,10 @@ namespace Emby.Server.Implementations.HttpServer.Security
             {
                 return true;
             }
+            if (authAttribtues.AllowLocalOnly && request.IsLocal)
+            {
+                return true;
+            }
 
             return false;
         }
@@ -159,12 +162,17 @@ namespace Emby.Server.Implementations.HttpServer.Security
                 return true;
             }
 
-            if (string.IsNullOrWhiteSpace(auth.Token))
+            if (authAttribtues.AllowLocalOnly && request.IsLocal)
+            {
+                return true;
+            }
+
+            if (string.IsNullOrEmpty(auth.Token))
             {
                 return true;
             }
 
-            if (tokenInfo != null && string.IsNullOrWhiteSpace(tokenInfo.UserId))
+            if (tokenInfo != null && tokenInfo.UserId.Equals(Guid.Empty))
             {
                 return true;
             }
@@ -225,7 +233,7 @@ namespace Emby.Server.Implementations.HttpServer.Security
 
         private void ValidateSecurityToken(IRequest request, string token)
         {
-            if (string.IsNullOrWhiteSpace(token))
+            if (string.IsNullOrEmpty(token))
             {
                 throw new SecurityException("Access token is required.");
             }
@@ -237,12 +245,7 @@ namespace Emby.Server.Implementations.HttpServer.Security
                 throw new SecurityException("Access token is invalid or expired.");
             }
 
-            if (!info.IsActive)
-            {
-                throw new SecurityException("Access token has expired.");
-            }
-
-            //if (!string.IsNullOrWhiteSpace(info.UserId))
+            //if (!string.IsNullOrEmpty(info.UserId))
             //{
             //    var user = _userManager.GetUserById(info.UserId);
 
diff --git a/Emby.Server.Implementations/HttpServer/Security/AuthorizationContext.cs b/Emby.Server.Implementations/HttpServer/Security/AuthorizationContext.cs
index a41c51d1a..ee8f6c60b 100644
--- a/Emby.Server.Implementations/HttpServer/Security/AuthorizationContext.cs
+++ b/Emby.Server.Implementations/HttpServer/Security/AuthorizationContext.cs
@@ -6,6 +6,7 @@ using System.Collections.Generic;
 using MediaBrowser.Model.Services;
 using System.Linq;
 using System.Threading;
+using MediaBrowser.Controller.Library;
 
 namespace Emby.Server.Implementations.HttpServer.Security
 {
@@ -13,11 +14,13 @@ namespace Emby.Server.Implementations.HttpServer.Security
     {
         private readonly IAuthenticationRepository _authRepo;
         private readonly IConnectManager _connectManager;
+        private readonly IUserManager _userManager;
 
-        public AuthorizationContext(IAuthenticationRepository authRepo, IConnectManager connectManager)
+        public AuthorizationContext(IAuthenticationRepository authRepo, IConnectManager connectManager, IUserManager userManager)
         {
             _authRepo = authRepo;
             _connectManager = connectManager;
+            _userManager = userManager;
         }
 
         public AuthorizationInfo GetAuthorizationInfo(object requestContext)
@@ -60,16 +63,16 @@ namespace Emby.Server.Implementations.HttpServer.Security
                 auth.TryGetValue("Token", out token);
             }
 
-            if (string.IsNullOrWhiteSpace(token))
+            if (string.IsNullOrEmpty(token))
             {
                 token = httpReq.Headers["X-Emby-Token"];
             }
 
-            if (string.IsNullOrWhiteSpace(token))
+            if (string.IsNullOrEmpty(token))
             {
                 token = httpReq.Headers["X-MediaBrowser-Token"];
             }
-            if (string.IsNullOrWhiteSpace(token))
+            if (string.IsNullOrEmpty(token))
             {
                 token = httpReq.QueryString["api_key"];
             }
@@ -94,8 +97,6 @@ namespace Emby.Server.Implementations.HttpServer.Security
 
                 if (tokenInfo != null)
                 {
-                    info.UserId = tokenInfo.UserId;
-
                     var updateToken = false;
 
                     // TODO: Remove these checks for IsNullOrWhiteSpace
@@ -109,15 +110,21 @@ namespace Emby.Server.Implementations.HttpServer.Security
                         info.DeviceId = tokenInfo.DeviceId;
                     }
 
+                    // Temporary. TODO - allow clients to specify that the token has been shared with a casting device
+                    var allowTokenInfoUpdate = info.Client == null || info.Client.IndexOf("chromecast", StringComparison.OrdinalIgnoreCase) == -1;
 
                     if (string.IsNullOrWhiteSpace(info.Device))
                     {
                         info.Device = tokenInfo.DeviceName;
                     }
+                    
                     else if (!string.Equals(info.Device, tokenInfo.DeviceName, StringComparison.OrdinalIgnoreCase))
                     {
-                        updateToken = true;
-                        tokenInfo.DeviceName = info.Device;
+                        if (allowTokenInfoUpdate)
+                        {
+                            updateToken = true;
+                            tokenInfo.DeviceName = info.Device;
+                        }
                     }
 
                     if (string.IsNullOrWhiteSpace(info.Version))
@@ -126,22 +133,38 @@ namespace Emby.Server.Implementations.HttpServer.Security
                     }
                     else if (!string.Equals(info.Version, tokenInfo.AppVersion, StringComparison.OrdinalIgnoreCase))
                     {
+                        if (allowTokenInfoUpdate)
+                        {
+                            updateToken = true;
+                            tokenInfo.AppVersion = info.Version;
+                        }
+                    }
+
+                    if ((DateTime.UtcNow - tokenInfo.DateLastActivity).TotalMinutes > 3)
+                    {
+                        tokenInfo.DateLastActivity = DateTime.UtcNow;
                         updateToken = true;
-                        tokenInfo.AppVersion = info.Version;
+                    }
+
+                    if (!tokenInfo.UserId.Equals(Guid.Empty))
+                    {
+                        info.User = _userManager.GetUserById(tokenInfo.UserId);
+
+                        if (info.User != null && !string.Equals(info.User.Name, tokenInfo.UserName, StringComparison.OrdinalIgnoreCase))
+                        {
+                            tokenInfo.UserName = info.User.Name;
+                            updateToken = true;
+                        }
                     }
 
                     if (updateToken)
                     {
-                        _authRepo.Update(tokenInfo, CancellationToken.None);
+                        _authRepo.Update(tokenInfo);
                     }
                 }
                 else
                 {
-                    var user = _connectManager.GetUserFromExchangeToken(token);
-                    if (user != null)
-                    {
-                        info.UserId = user.Id.ToString("N");
-                    }
+                    info.User = _connectManager.GetUserFromExchangeToken(token);
                 }
                 httpReq.Items["OriginalAuthenticationInfo"] = tokenInfo;
             }
@@ -160,7 +183,7 @@ namespace Emby.Server.Implementations.HttpServer.Security
         {
             var auth = httpReq.Headers["X-Emby-Authorization"];
 
-            if (string.IsNullOrWhiteSpace(auth))
+            if (string.IsNullOrEmpty(auth))
             {
                 auth = httpReq.Headers["Authorization"];
             }
@@ -212,7 +235,7 @@ namespace Emby.Server.Implementations.HttpServer.Security
 
         private string NormalizeValue(string value)
         {
-            if (string.IsNullOrWhiteSpace(value))
+            if (string.IsNullOrEmpty(value))
             {
                 return value;
             }
diff --git a/Emby.Server.Implementations/HttpServer/Security/SessionContext.cs b/Emby.Server.Implementations/HttpServer/Security/SessionContext.cs
index 9826a0d56..a919ce008 100644
--- a/Emby.Server.Implementations/HttpServer/Security/SessionContext.cs
+++ b/Emby.Server.Implementations/HttpServer/Security/SessionContext.cs
@@ -5,6 +5,7 @@ using MediaBrowser.Controller.Security;
 using MediaBrowser.Controller.Session;
 using System.Threading.Tasks;
 using MediaBrowser.Model.Services;
+using System;
 
 namespace Emby.Server.Implementations.HttpServer.Security
 {
@@ -21,11 +22,11 @@ namespace Emby.Server.Implementations.HttpServer.Security
             _sessionManager = sessionManager;
         }
 
-        public Task<SessionInfo> GetSession(IRequest requestContext)
+        public SessionInfo GetSession(IRequest requestContext)
         {
             var authorization = _authContext.GetAuthorizationInfo(requestContext);
 
-            var user = string.IsNullOrWhiteSpace(authorization.UserId) ? null : _userManager.GetUserById(authorization.UserId);
+            var user = authorization.User;
             return _sessionManager.LogSessionActivity(authorization.Client, authorization.Version, authorization.DeviceId, authorization.Device, requestContext.RemoteIp, user);
         }
 
@@ -36,19 +37,19 @@ namespace Emby.Server.Implementations.HttpServer.Security
             return info as AuthenticationInfo;
         }
 
-        public Task<SessionInfo> GetSession(object requestContext)
+        public SessionInfo GetSession(object requestContext)
         {
             return GetSession((IRequest)requestContext);
         }
 
-        public async Task<User> GetUser(IRequest requestContext)
+        public User GetUser(IRequest requestContext)
         {
-            var session = await GetSession(requestContext).ConfigureAwait(false);
+            var session = GetSession(requestContext);
 
-            return session == null || !session.UserId.HasValue ? null : _userManager.GetUserById(session.UserId.Value);
+            return session == null || session.UserId.Equals(Guid.Empty) ? null : _userManager.GetUserById(session.UserId);
         }
 
-        public Task<User> GetUser(object requestContext)
+        public User GetUser(object requestContext)
         {
             return GetUser((IRequest)requestContext);
         }