CervantesSec / cervantes

Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients, vulnerabilities, and reports in a single, centralized location.
https://www.cervantessec.org/
Apache License 2.0
283 stars 42 forks source link

Unable to Create New Task Due to Null 'AssignedUserId' Error #62

Closed jstangle closed 1 week ago

jstangle commented 2 weeks ago

Hello, I would like to report an issue with TASKS. Users are unable to create new tasks within a project's workspace. When attempting to save a new task, an error occurs due to a null value in the "AssignedUserId". As a result, task creation fails. The error message provides details about the issue, and the log is included below for reference.

image

Steps to Reproduce

1) Create a new project and go to "My Workspaces". 2) Open the project's "Workspace" and navigate to "Tasks". 3) When attempting to create a new task, it's not possible, and an error message appears. See the log below.

Microsoft.EntityFrameworkCore.DbUpdateException: An error occurred while saving the entity changes. See the inner exception for details. ---> Npgsql.PostgresException (0x80004005): 23502: null value in column "AsignedUserId" of relation "Tasks" violates not-null constraint DETAIL: Detail redacted as it may contain sensitive data. Specify 'Include Error Detail' in the connection string to include this information. at Npgsql.Internal.NpgsqlConnector.ReadMessageLong(Boolean async, DataRowLoadingMode dataRowLoadingMode, Boolean readingNotifications, Boolean isReadingPrependedMessage) at System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder1.StateMachineBox1.System.Threading.Tasks.Sources.IValueTaskSource<TResult>.GetResult(Int16 token) at Npgsql.NpgsqlDataReader.NextResult(Boolean async, Boolean isConsuming, CancellationToken cancellationToken) at Npgsql.NpgsqlDataReader.NextResult(Boolean async, Boolean isConsuming, CancellationToken cancellationToken) at Npgsql.NpgsqlCommand.ExecuteReader(Boolean async, CommandBehavior behavior, CancellationToken cancellationToken) at Npgsql.NpgsqlCommand.ExecuteReader(Boolean async, CommandBehavior behavior, CancellationToken cancellationToken) at Npgsql.NpgsqlCommand.ExecuteDbDataReaderAsync(CommandBehavior behavior, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReaderAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReaderAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.Update.ReaderModificationCommandBatch.ExecuteAsync(IRelationalConnection connection, CancellationToken cancellationToken) Exception data: Severity: ERROR SqlState: 23502 MessageText: null value in column "AsignedUserId" of relation "Tasks" violates not-null constraint Detail: Detail redacted as it may contain sensitive data. Specify 'Include Error Detail' in the connection string to include this information. SchemaName: public TableName: Tasks ColumnName: AsignedUserId File: execMain.c Line: 2003 Routine: ExecConstraints --- End of inner exception stack trace --- at Microsoft.EntityFrameworkCore.Update.ReaderModificationCommandBatch.ExecuteAsync(IRelationalConnection connection, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.Update.Internal.BatchExecutor.ExecuteAsync(IEnumerable1 commandBatches, IRelationalConnection connection, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.Update.Internal.BatchExecutor.ExecuteAsync(IEnumerable1 commandBatches, IRelationalConnection connection, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.Update.Internal.BatchExecutor.ExecuteAsync(IEnumerable1 commandBatches, IRelationalConnection connection, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(IList1 entriesToSave, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(StateManager stateManager, Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken) at Npgsql.EntityFrameworkCore.PostgreSQL.Storage.Internal.NpgsqlExecutionStrategy.ExecuteAsync[TState,TResult](TState state, Func4 operation, Func4 verifySucceeded, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync(Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync(Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken) at Cervantes.Web.Controllers.TaskController.Add(TaskCreateViewModel model) in /src/Cervantes.Web/Controllers/TaskController.cs:line 182

mesquidar commented 2 weeks ago

Hi @jstangle thanks for reporting this issue I will take it a look and I will let you know :)

Thank you Best regards

mesquidar commented 2 weeks ago

Hi @jstangle to confirm the steps:

  1. Create a new project and go to "My Workspaces".
  2. Open the project's "Workspace" and navigate to "Tasks".
  3. When attempting to create a new task, click on create task wihtout selecting user notification error appears and the assign the users and it breaks

I created a new a image if you want to test it :) I added by default that the assigned user the creator of the task if not changed (so in this case assigned user is never null)

Thank you Best regards

jstangle commented 2 weeks ago

Hi Ruben, thank you for the update! :) I was considering whether it would be better if it were possible to create a task without the need to assign it. For example, at the beginning of an engagement, someone could create a few tasks, and users could pick them up as they want.

mesquidar commented 1 week ago

Hi @jstangle makes sense what are you saying I will add it in the nexts updates :) For the moment I will left the default assigned user is the one who opens the task to avoid the null reference

jstangle commented 1 week ago

I see :) Thank you!

mesquidar commented 1 week ago

Hi @jstangle I already implemented the feature now you can create tasks without the need to assign the task to someone. The new image it's already available :)

Best regards