From 62a5ded9205b10ddaef60ce3e05bf80e79f4c742 Mon Sep 17 00:00:00 2001
From: Shadowghost <Ghost_of_Stone@web.de>
Date: Fri, 17 Jul 2026 17:04:31 +0200
Subject: Prevent unauthenticated re-run of the startup wizard on
 misconfiguration

---
 Emby.Server.Implementations/ApplicationHost.cs | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

(limited to 'Emby.Server.Implementations')

diff --git a/Emby.Server.Implementations/ApplicationHost.cs b/Emby.Server.Implementations/ApplicationHost.cs
index 69e23bcb63..0c1c7d3f5b 100644
--- a/Emby.Server.Implementations/ApplicationHost.cs
+++ b/Emby.Server.Implementations/ApplicationHost.cs
@@ -39,6 +39,8 @@ using Emby.Server.Implementations.SyncPlay;
 using Emby.Server.Implementations.TV;
 using Emby.Server.Implementations.Updates;
 using Jellyfin.Api.Helpers;
+using Jellyfin.Data;
+using Jellyfin.Database.Implementations.Enums;
 using Jellyfin.Drawing;
 using Jellyfin.MediaEncoding.Hls.Playlist;
 using Jellyfin.Networking.Manager;
@@ -417,6 +419,8 @@ namespace Emby.Server.Implementations
         {
             Logger.LogInformation("Running startup tasks");
 
+            EnsureStartupWizardIntegrity();
+
             Resolve<ITaskManager>().AddTasks(GetExports<IScheduledTask>(false));
 
             ConfigurationManager.ConfigurationUpdated += OnConfigurationUpdated;
@@ -436,6 +440,24 @@ namespace Emby.Server.Implementations
             return Task.CompletedTask;
         }
 
+        private void EnsureStartupWizardIntegrity()
+        {
+            if (ConfigurationManager.CommonConfiguration.IsStartupWizardCompleted)
+            {
+                return;
+            }
+
+            var hasConfiguredAdministrator = Resolve<IUserManager>().GetUsers()
+                .Any(user => user.HasPermission(PermissionKind.IsAdministrator) && !string.IsNullOrEmpty(user.Password));
+
+            if (hasConfiguredAdministrator)
+            {
+                Logger.LogWarning("The startup wizard is marked incomplete but a configured administrator already exists. Marking setup as completed to prevent the unauthenticated setup endpoints from being reachable.");
+                ConfigurationManager.Configuration.IsStartupWizardCompleted = true;
+                ConfigurationManager.SaveConfiguration();
+            }
+        }
+
         /// <inheritdoc/>
         public void Init(IServiceCollection serviceCollection)
         {
-- 
cgit v1.2.3