From 810d554cb94ff98afa6362c771b046f92959d8c6 Mon Sep 17 00:00:00 2001
From: schn33fuchs <silas.raffauf@raffauf-clan.de>
Date: Fri, 5 Jun 2026 21:35:54 +0200
Subject: [PATCH] Fixed bug

You could set the password to be an empty string
---
 backend/src/handlers/auth.rs | 57 +++++++++++++++++++++---------------
 frontend/src/pages/user.rs   |  4 ++-
 2 files changed, 37 insertions(+), 24 deletions(-)

diff --git a/backend/src/handlers/auth.rs b/backend/src/handlers/auth.rs
index 4d251cb..282ee96 100644
--- a/backend/src/handlers/auth.rs
+++ b/backend/src/handlers/auth.rs
@@ -275,7 +275,7 @@ pub async fn get_current_user(
 /// - `404 Not Found` if user doesn't exist
 /// - `500 Internal Server Error` if database error occurs
 pub async fn delete_user(
-    Path(id): Path<i32>,
+    Path(id): Path<i16>,
     State(data): State<Arc<AppState>>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
     let query = sqlx::query(r#"DELETE FROM users WHERE id = $1"#)
@@ -414,32 +414,43 @@ pub async fn get_user_by_id(
 /// - Passwords are hashed using Argon2 before storage.
 /// - This endpoint typically requires admin privileges (enforced by middleware).
 pub async fn update_user(
-    Path(id): Path<i32>,
+    Path(id): Path<i16>,
     State(data): State<Arc<AppState>>,
     Json(body): Json<UserUpdateScheme>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
-    let argon = Argon2::default();
-    let salt = SaltString::generate(&mut OsRng);
-    let hashed_pwd = match argon.hash_password(body.new_pwd.clone().as_bytes(), &salt) {
-        Ok(h) => h.to_string(),
-        Err(e) => panic!("Error hashing {:}", e),
-    };
+    let update_result = if !body.new_pwd.is_empty() {
+        let argon = Argon2::default();
+        let salt = SaltString::generate(&mut OsRng);
+        let hashed_pwd = match argon.hash_password(body.new_pwd.clone().as_bytes(), &salt) {
+            Ok(h) => h.to_string(),
+            Err(e) => panic!("Error hashing {:}", e),
+        };
 
-    let update_result = sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, pwd = $4, is_admin = $5 WHERE id = $6"#)
-        .bind(body.first_name.to_owned())
-        .bind(body.last_name.to_owned())
-        .bind(body.username.to_owned())
-        .bind(&hashed_pwd)
-        .bind(body.make_admin.to_owned())
-        .bind(id)
-        .execute(&data.db)
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                Json(json!({"status": "error", "message": format!("{:?}", e)})),
-            )
-        })?;
+        sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, pwd = $4, is_admin = $5 WHERE id = $6"#)
+            .bind(body.first_name.to_owned())
+            .bind(body.last_name.to_owned())
+            .bind(body.username.to_owned())
+            .bind(hashed_pwd)
+            .bind(body.make_admin.to_owned())
+            .bind(id)
+            .execute(&data.db)
+            .await
+    } else {
+        sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, is_admin = $4 WHERE id = $5"#)
+            .bind(body.first_name.to_owned())
+            .bind(body.last_name.to_owned())
+            .bind(body.username.to_owned())
+            .bind(body.make_admin.to_owned())
+            .bind(id)
+            .execute(&data.db)
+            .await
+    }
+    .map_err(|e| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({"status": "error", "message": format!("{:?}", e)})),
+        )
+    })?;
 
     if update_result.rows_affected() == 0 {
         let error_response = serde_json::json!({
diff --git a/frontend/src/pages/user.rs b/frontend/src/pages/user.rs
index fdc3841..0b93d1b 100644
--- a/frontend/src/pages/user.rs
+++ b/frontend/src/pages/user.rs
@@ -336,7 +336,7 @@ pub fn login_component() -> Html {
                 value={(*username).clone()}
                 oninput={Callback::from(move |e: InputEvent| {
                     let input: web_sys::HtmlInputElement = e.target_unchecked_into();
-                    username.set(input.value());           
+                    username.set(input.value());
                     })}
             />
             <input
@@ -566,6 +566,7 @@ pub fn user_by_id_component(props: &UserProps) -> Html {
             let last_name = (*last_name).clone();
             let username = (*username).clone();
             let make_admin = *make_admin;
+            let new_pwd_state = new_pwd.clone();
             let new_pwd = (*new_pwd).clone();
 
             saving.set(true);
@@ -600,6 +601,7 @@ pub fn user_by_id_component(props: &UserProps) -> Html {
                         if let Ok(updated) = resp.json::<FilteredUser>().await {
                             user_state.set(Some(updated));
                         }
+                        new_pwd_state.set(String::new());
                         save_success.set(true);
                     }
                     Ok(resp) => {