JagandeepBrar / lunasea

Self-hosted software controller built using Flutter
https://www.lunasea.app
GNU General Public License v3.0
1.31k stars 64 forks source link

[Bug] Some special characters in an NZBGet username or password can cause connection errors #165

Closed JagandeepBrar closed 4 years ago

JagandeepBrar commented 4 years ago

Describe the Bug When a user has a special character (such as /) in their username or password, it will cause the authentication to fail.

To Reproduce Have a special character in your password such as /.

Expected Behaviour Authentication to work.

Versions v2.0.0 (44).

Additional context Can take a look into URL-encoding the password and username to see if it helps with special characters.

JagandeepBrar commented 4 years ago

An update for those following this, the way NZBGet is currently authenticated is as follows:

<host>/<username>:<password>/jsonrpc/...

Because of this, special characters can cause the password to be submitted early. This works fine for most characters (#, $, etc) but characters like / or \ can cause problems because it is terminating the password or username early.

HTML encoding the username and password does not work, and I have made an issue on NZBGet's repository to request this change: https://github.com/nzbget/nzbget/issues/682

Unless this gets changed, specific special characters can't be supported in LunaSea :(

JagandeepBrar commented 4 years ago

I have implemented a workaround in https://github.com/LunaSeaApp/LunaSea/commit/d568ee641497577ab45b6aa88e9d5c522f659332. This gives users the option to use basic authentication instead of URL-encoded authentication.

As noted in the dialog prompt, using basic authentication will interfere with custom authentication setups, but allow more complex passwords to be used (any character can be used, tested password was: pass#!:$%^/\word

JagandeepBrar commented 4 years ago

The issue will remain open until the fix is implemented into the production builds.