error when using wrong username or password

[gaz003]

I have setup a new copy of Home Access Plus V10.0 on a 2016 server. All tested and working great. The only issue I have is if a student puts the wrong username or password in they get a error below rather than a incorrect username and password try again. I am hoping this is a simple fix? if anyone can help it would be greatly appreciated

 

Server Error in '/HAP' Application.

________________________________________

Index was out of range. Must be non-negative and less than the size of the collection.

Parameter name: index

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

 

Exception Details: System.ArgumentOutOfRangeException: Index was out of range. Must be non-negative and less than the size of the collection.

Parameter name: index

 

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

 

Stack Trace:

 

[ArgumentOutOfRangeException: Index was out of range. Must be non-negative and less than the size of the collection.

Parameter name: index]

System.Collections.ArrayList.get_Item(Int32 index) +13824396

System.DirectoryServices.SearchResultCollection.get_Item(Int32 index) +27

HAP.AD.User.UserAccountControl(String username) +143

HAP.Web.Login.login_Click(Object sender, EventArgs e) +1170

System.Web.UI.WebControls.LinkButton.OnClick(EventArgs e) +143

System.Web.UI.WebControls.LinkButton.RaisePostBackEvent(String eventArgument) +148

System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1735

[RCoon]

I'd also like a less terrifying solution for this error so users don't email me telling me the Files system is horribly broken, when in fact, they just mistyped their username.

[johnabbots]

@nickbro . Its not a massive problem but if you can suggest anything to help I'd really appreciate it.

 

I am using version 10.5 and only get this error when the wrong username is entered everything else is working really well.

 

A few other threads have the same issue but no one seems to have a fix yet:

 

http://www.edugeek.net/forums/home-access-plus/175146-server-error-hap-application.html

http://www.edugeek.net/forums/home-access-plus/182039-hap-wrong-login-shows-error-code.html

http://www.edugeek.net/forums/home-access-plus/156514-incorrect-login-name-bombs-out.html

http://www.edugeek.net/forums/home-access-plus/155605-wrong-user-name-gives-index-out-range-must-non-negative-less-than.html

 

The exact error in the application event log is:

 

Event code: 3005 Event message: An unhandled exception has occurred. Event time: 05/02/2019 14:48:51 Event time (UTC): 05/02/2019 14:48:51 Event ID: a146264c45a94a77a242a0ebfca41fcc Event sequence: 22882 Event occurrence: 23 Event detail code: 0 Application information: Application domain: /LM/W3SVC/1/ROOT/hap-1-131937601834885634 Trust level: Full Application Virtual Path: /hap Application Path: C:\inetpub\wwwroot\hap\ Machine name: WEBSERVER Process information: Process ID: 7644 Process name: w3wp.exe Account name: IIS APPPOOL\HAP Exception information: Exception type: ArgumentOutOfRangeException Exception message: Index was out of range. Must be non-negative and less than the size of the collection.Parameter name: index at System.Collections.ArrayList.get_Item(Int32 index) at System.DirectoryServices.SearchResultCollection.get_Item(Int32 index) at HAP.AD.User.UserAccountControl(String username) at HAP.Web.Login.login_Click(Object sender, EventArgs e) at System.Web.UI.WebControls.LinkButton.OnClick(EventArgs e) at System.Web.UI.WebControls.LinkButton.RaisePostBackEvent(String eventArgument) at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) Request information: Request URL: https://myfiles.school.devon.sch.uk:443/hap/login.aspx Request path: /hap/login.aspx User: Is authenticated: False Authentication Type: Thread account name: IIS APPPOOL\HAP Thread information: Thread ID: 27 Thread account name: IIS APPPOOL\HAP Is impersonating: False Stack trace: at System.Collections.ArrayList.get_Item(Int32 index) at System.DirectoryServices.SearchResultCollection.get_Item(Int32 index) at HAP.AD.User.UserAccountControl(String username) at HAP.Web.Login.login_Click(Object sender, EventArgs e) at System.Web.UI.WebControls.LinkButton.OnClick(EventArgs e) at System.Web.UI.WebControls.LinkButton.RaisePostBackEvent(String eventArgument) at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Thanks very much and thanks for all your work with this project.

[lmgtfy]

@nickbro I second this I would love to see if there is a way to sort this out.

 

Cheers

[marcfielding]

Hi,

 

I'm a parent of a child at Stantonbury school in Milton Keynes, I actually discovered this whilst doing some testing on schools security - my main problems with this are two fold:

 

1) It appears user input isn't sanitized, so during my testing I had placed ";SHOW TABLES" as a username

2) When I was informed as to how the backend is linkedin up(I'm not going to place it here for obvious reasons) then there still appears to be a possibility of LDAP injection

 

Having not seen the source code I can't really comment, but this should be, I think a top priority.

[lmgtfy]

@nickbro I'm not sure about the above, can you help at all?

[nickbro]

I'm not actively developing this project anymore sorry to say. I would suggest moving to Windows Authentication and Azure App Proxy. It's one of the things we moved to to further reduce the exposure.

 

When I try logging into a test build of hap using the username ;SHOW TABLES, I just get that the username doesn't exist error prompt on the login page. In fact I've banned my ip by trying that too many times. Make sure you have custom errors turned On.

 

Since the code uses a AD Searcher you cannot manipulate AD (write) and it errors out if such a injection attempt is attempted. The core authentication system uses Microsoft's ASP.net AD Membership authentication.

 

Make sure you are using HAP.AD.dll 5.6, And at least v10.5 of the hap

[johnabbots]

@nickbro thanks for your help. Its a real shame that the project is not being developed any longer. I know so many Schools that use it, you should have started selling it and you could have retired :-)