redfish session: fix null ptr dereference
The session post handler creates a session object locally before setting
the reference in the request object. When the user's password has
expired, don't look for session information (like the username) via the
request object reference.
Tested: Prior to this change, posting to the Session collection will
cause bmcweb to crash when the user's password is expired. With this
change applied, the user is logged in with the correct configure self
role and Base.1.11.0.PasswordChangeRequired is returned in the response.
The user can subsequently change their password using the session.
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Change-Id: I3014181af71f75e65f6640efe47064d7adc1e9e9
diff --git a/redfish-core/lib/redfish_sessions.hpp b/redfish-core/lib/redfish_sessions.hpp
index af01e05..84657d4 100644
--- a/redfish-core/lib/redfish_sessions.hpp
+++ b/redfish-core/lib/redfish_sessions.hpp
@@ -230,7 +230,7 @@
messages::passwordChangeRequired(
asyncResp->res,
crow::utility::urlFromPieces("redfish", "v1", "AccountService",
- "Accounts", req.session->username));
+ "Accounts", session->username));
}
fillSessionObject(asyncResp->res, *session);