Cannot set User Password using API

[labor4 0]

Hi

 

I'm trying to update a freshly created user's password but I get a mean error.

2019-04-15 07:11:46.895 Info HttpServer: HTTP POST http://10.20.40.95:8096/Users/723937d5c0244451af66f412b6551f84/Password. UserAgent: 
2019-04-15 07:11:46.898 Error HttpServer: Error processing request
	*** Error Report ***
	Version: 4.1.0.24
	Command line: /opt/emby-server/system/EmbyServer.dll -programdata /var/lib/emby -ffdetect /opt/emby-server/bin/ffdetect -ffmpeg /opt/emby-server/bin/ffmpeg -ffprobe /opt/emby-server/bin/ffprobe -restartexitcode 3 -updatepackage emby-server-deb_{version}_amd64.deb
	Operating system: Unix 4.15.0.47
	64-Bit OS: True
	64-Bit Process: True
	User Interactive: True
	Runtime: file:///opt/emby-server/system/System.Private.CoreLib.dll
	Processor count: 7
	Program data path: /var/lib/emby
	Application directory: /opt/emby-server/system
	System.NullReferenceException: System.NullReferenceException: Object reference not set to an instance of an object.
	   at MediaBrowser.Api.BaseApiService.AssertCanUpdateUser(IAuthorizationContext authContext, IUserManager userManager, Int64 userId, Boolean restrictUserPreferences)
	   at MediaBrowser.Api.UserService.PostAsync(UpdateUserPassword request)
	   at Emby.Server.Implementations.Services.ServiceExecGeneral.GetTaskResult(Task task)
	   at Emby.Server.Implementations.Services.ServiceHandler.ProcessRequestAsync(HttpListenerHost appHost, IRequest httpReq, IResponse httpRes, ILogger logger, String operationName, CancellationToken cancellationToken)
	   at Emby.Server.Implementations.HttpServer.HttpListenerHost.RequestHandler(IRequest httpReq, String urlString, String host, String localPath, CancellationToken cancellationToken)
	Source: MediaBrowser.Api
	TargetSite: Void AssertCanUpdateUser(MediaBrowser.Controller.Net.IAuthorizationContext, MediaBrowser.Controller.Library.IUserManager, Int64, Boolean)
	
2019-04-15 07:11:46.899 Info HttpServer: HTTP Response 500 to 10.20.40.91. Time: 3ms. http://10.20.40.95:8096/Users/723937d5c0244451af66f412b6551f84/Password

I am posting:

Host: 10.20.40.95:8096
X-Emby-Token:isset
Content-Type:application/json
Accept: */*
Content-Length: 31

with post data:

 

'{"CurrentPw":"","NewPw":"1234"}'

It seems quite similar like the GUI itself does it in the XHR log.

Can somebody help?

This is from a different host, but doing it on same host fails the same.

 

I did this via API key, maybe for an admin to change other users PW is only possible via sessions?

Other GET/POST/DELETE requests work well.

 

Version 4.1.0.24 beta

 

thanks

 

 

[labor4 0]

Same with Version 4.1.0.25 beta

[Luke 42077]

Hi there, have you tried using the chrome debugger to compare your requests to what the web app is doing?

[labor4 0]

I did something similar in Safari, yes.

But I think i narrowed it down.

 

I think the problem is, that the API keys generated in the GUI as in

https://github.com/MediaBrowser/Emby/wiki/Api-Key-Authentication

 

... don't have the scope for setting passwords.

But if, as an admin, I open the swagger API framework, it inserts an API key as a GET variable, that probably belongs to the admin user, and therefore works in my script, too.

 

However, that admin key only works if that user is currently logged in via browser.

 

Can you confirm?

If so, the regular API key generator probably needs something like a superuser checkbox or so.

Edited April 16, 2019 by labor4

[labor4 0]

The workaround was to create a new user with admin rights, and use this with 

https://github.com/MediaBrowser/Emby/wiki/User-Authentication

to get a temporary token.