This is an automated email from the ASF dual-hosted git repository. DaanHoogland pushed a commit to branch ghi13815-NPEwhileSkippingSSOcheck in repository https://gitbox.apache.org/repos/asf/cloudstack.git
commit e3074a0e230ea231afc2411443c99b06880b1f7f Author: Daan Hoogland <[email protected]> AuthorDate: Thu Aug 13 12:47:50 2026 +0200 npe guard on missing session attribute --- server/src/main/java/com/cloud/api/ApiServlet.java | 2 +- server/src/test/java/com/cloud/api/ApiServletTest.java | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/server/src/main/java/com/cloud/api/ApiServlet.java b/server/src/main/java/com/cloud/api/ApiServlet.java index 64308cc9e6b..8f9b6f03d87 100644 --- a/server/src/main/java/com/cloud/api/ApiServlet.java +++ b/server/src/main/java/com/cloud/api/ApiServlet.java @@ -422,7 +422,7 @@ public class ApiServlet extends HttpServlet { protected boolean skip2FAcheckForUser(HttpSession session) { boolean skip2FAcheck = false; Long userId = (Long) session.getAttribute("userid"); - boolean is2FAverified = (boolean) session.getAttribute(ApiConstants.IS_2FA_VERIFIED); + boolean is2FAverified = Boolean.TRUE.equals(session.getAttribute(ApiConstants.IS_2FA_VERIFIED)); if (is2FAverified) { LOGGER.debug(String.format("Two factor authentication is already verified for the user %d, so skipping", userId)); skip2FAcheck = true; diff --git a/server/src/test/java/com/cloud/api/ApiServletTest.java b/server/src/test/java/com/cloud/api/ApiServletTest.java index 4d4f0a12098..eab059a91bf 100644 --- a/server/src/test/java/com/cloud/api/ApiServletTest.java +++ b/server/src/test/java/com/cloud/api/ApiServletTest.java @@ -333,6 +333,23 @@ public class ApiServletTest { Assert.assertEquals(true, result); } + @Test + public void testSkip2FAcheckForUserWhenVerifiedAttributeIsAbsent() { + servlet.accountMgr = accountMgr; + Mockito.when(session.getAttribute("userid")).thenReturn(1L); + Mockito.when(session.getAttribute(ApiConstants.IS_2FA_VERIFIED)).thenReturn(null); + Mockito.when(accountMgr.getUserAccountById(1L)).thenReturn(userAccount); + Mockito.when(userAccount.getDomainId()).thenReturn(1L); + Mockito.when(userAccount.isUser2faEnabled()).thenReturn(false); + + ConfigKey<Boolean> enableUserTwoFactorAuthentication = Mockito.mock(ConfigKey.class); + AccountManagerImpl.enableUserTwoFactorAuthentication = enableUserTwoFactorAuthentication; + Mockito.when(enableUserTwoFactorAuthentication.valueIn(1L)).thenReturn(false); + + boolean result = servlet.skip2FAcheckForUser(session); + Assert.assertEquals(true, result); + } + @Test public void testDoNotSkip2FAcheckForUserWhen2FAEnabled() { servlet.accountMgr = accountMgr;
