Ombi: Application URL is adding token info

[sodajim]

Describe the bug
Whenever a user tries to use the reset their password link the Application URL adds the following "/token?token=" and keeps adding this every time someone clicks on the reset password link.

To Reproduce
Steps to reproduce the behavior:
1.User visits application URL

1. User clicks on reset password link
2. User enters their email address and hits reset password
3. password reset fails because URL is not correct and it displays "Invalid Token"

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: Ubuntu 18.04.2

Ombi Version (please complete the following information):

• Version 3.0.4256

• Media Server Plex

Additional context
Thanks for your work!

[tidusjar]

Please provide the application URL you have entered? Just the format will
be fine

On Tue, 5 Mar 2019, 3:24 am sodajim, [e-mail] wrote:

Describe the bug
Whenever a user tries to use the reset their password link the Application
URL adds the following URI "/token?token=" and keeps adding this every time
someone clicks on the reset password link.

To Reproduce
Steps to reproduce the behavior:
1.User visits application URL

1. User clicks on reset password link
2. User enters their email address and hits reset password
3. password reset fails because URL/URI is not correct and it displays
   "Invalid Token"

Screenshots
If applicable, add screenshots to help explain your problem.
[image: image]
https://user-images.githubusercontent.com/48231895/53778698-45141680-3ec3-11e9-81cf-e1caf53ee1b8.png

Desktop (please complete the following information):

• OS: Ubuntu 18.04.2

Ombi Version (please complete the following information):

-

Version 3.0.4256
-

Media Server Plex

Additional context
Thanks for your work!

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/tidusjar/Ombi/issues/2865, or mute the thread
https://github.com/notifications/unsubscribe-auth/AGVaLInXUOYUq-g09IMVCWfre6X5-Welks5vTeN5gaJpZM4bdrve
.

[sodajim]

I have tried a few.
http://media.myserver.xyz
http://media.myserver.xyz/
http://media.myserver.xyz/ombi
http://media.myserver.xyz/ombi/

[tidusjar]

I cannot seem to reproduce it. Is this for a ombi user?

[sodajim]

I was able to reproduce it with a local user and a plex imported user.

On Thu, Mar 7, 2019 at 2:58 PM Jamie [e-mail] wrote:

I cannot seem to reproduce it. Is this for a ombi user?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/tidusjar/Ombi/issues/2865#issuecomment-470691455, or mute
the thread
https://github.com/notifications/unsubscribe-auth/At_111uk0EYSPmh4S74ejw6rXdP9GSJrks5vUX1vgaJpZM4bdrve
.

[Generalnoob]

For me it happens everytime I try to send a password reset link, hope this helps

[Generalnoob]

will this be addressed soon please, I have done a fresh install on ubuntu 18.* lts and this is still happening on a brand new server

[tidusjar]

Please keep in mind that Ombi is not my primary job, I do not get paid to support and maintain Ombi. I currently have a full time job, 2 year old child, wife and puppy at home so my life is pretty busy without Ombi.

Any free time that I have is dedicated to Ombi and there are many many things to do on this project. So if I have not yet got around to fixing this then apologies, but I'm the only dev and I'm only human :smile:

[Generalnoob]

ok bud just checking :)

[byusinger84]

This is also happening to me on Windows. Only seems to happen with Plex users.

Whenever I send a welcome email to a Plex user and they click on the generated link, it adds token gibberish to the end of the application url.

[SiGmAX666]

I have the bug as well for local users. I haven't tried for Plex users.

Ubuntu 18.04.3 LTS
Docker 19.03.2, build 6a30dfc
Ombi 3.0.4680
Plex Media Server

I don't know how to debug C# webapps and I've never coded in C#, but from reading the code, I suspect the issue relates to how IdentityController.cs calls AddToUrl at line 778, and then what AddToUrl does. It appears that AddToUrl within CustomizationSettings.cs is actually modifying customizationSettings.ApplicationUrl vs returning the ApplicationUrl plus the string passed to it (part). I searched through all the code and from what my editor is returning, the only time AddToUrl is called is from the IdentityController module.

IdentityController.cs Lines 778-779:

customizationSettings.AddToUrl("/token?token=");
var url = customizationSettings.ApplicationUrl;

CustomizationSettings.cs

public void AddToUrl(string part)
{
    if (string.IsNullOrEmpty(ApplicationUrl))
    {
        ApplicationUrl = part;
    }

    if (ApplicationUrl.EndsWith("/"))
    {
        ApplicationUrl.Remove(ApplicationUrl.Length - 1);
    }
    if (!part.StartsWith("/"))
    {
        part = "/" + part;
    }
    ApplicationUrl = ApplicationUrl + part;
}

I think AddToUrl should be returning a concatenated string, not updating the ApplicationUrl object. But I could be misunderstanding what is happening somewhere else in the code!

[tidusjar]

Thanks for the investigation, you are probably correct, at some point it seems that it must be persisted back to the database.

[vsc55]

Hi,
I wanted to add a note.
It seems some Frontend failure, since "/token?Token=" is only added in the UI.
If you look for the ApplicationUrl option in the database, it appears correctly.