From d4389b70686a60c707038bc1818f8a4b3fa324e9 Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Wed, 15 Jul 2026 22:42:24 +0800 Subject: [PATCH] fix(rbac): guard None current_user on websocket auth failure get_current_active_user_from_websocket returns None after closing the socket on an auth failure (revoked token, bad credentials, inactive user). has_privilege_on_websocket dereferenced current_user.is_superadmin without a None check, so any websocket auth failure surfaced as an AttributeError traceback instead of a clean close. Bail out early when current_user is None, mirroring the guard already present in ws_console. --- gns3server/api/routes/controller/dependencies/rbac.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/gns3server/api/routes/controller/dependencies/rbac.py b/gns3server/api/routes/controller/dependencies/rbac.py index e67953486..41f4cbd0d 100644 --- a/gns3server/api/routes/controller/dependencies/rbac.py +++ b/gns3server/api/routes/controller/dependencies/rbac.py @@ -52,6 +52,10 @@ def has_privilege_on_websocket( current_user: schemas.User = Depends(get_current_active_user_from_websocket), rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)) ): + # Authentication may have failed and closed the socket inside the auth + # dependency, returning None — bail out before touching the user object. + if current_user is None: + return None if not current_user.is_superadmin: path = re.sub(r"^/v[0-9]", "", websocket.url.path) # remove the prefix (e.g. "/v3") from URL path log.debug(f"Checking user {current_user.username} has privilege {privilege_name} on '{path}'")