pgAdmin imports servers to the wrong accounts in the server version with webserver auth enabled

[konradziczek]

Please note that security bugs or issues should be reported to [email protected].

Describe the bug

After importing the .json file with the server, sometimes (not always) it is imported to another user's account, and the list of servers in my account is still empty. The problem never appears when creating a server manually.

To Reproduce

The main thing that I think may be related to the problem is that I am using the following configuration:
AUTHENTICATION_SOURCES = ['webserver']

Users are authorized using basic auth, and the accounts are retrieved by a PHP script. Such accounts in the pgAdmin sqlite database do not have an email, only a username.

Expected behavior

Servers are always imported under the account of the user who imports them.

Error message

No error message - after import, a message appears stating that the operation was successful.

Screenshots

Select from pgAdmin sqlite "server" table:

The last server was imported on user 12 and as you can see it was added on user 2. User 2 confirmed to me that he sees the server imported on my account in his account.

Desktop (please complete the following information):

• OS: Rocky Linux 9
• Version: 7.6 (docker latest)
• Mode: Server
• Browser (if running in server mode): Firefox
• Package type: Docker

Additional context

Add any other context about the problem here.

[konradziczek]

I think I found where the problem is:

pgadmin4/web/pgadmin/utils/__init__.py

Line 810 in 0b3c798

new_user = User.query.filter_by(email=user).first()

There are no email addresses in webserver auth method, only usernames. For this reason, it searches for users with an empty email address and provides any one.

[konradziczek]

Bugfix proposed #6818

[adityatoshniwal]

Hi @amarel123,
Can you confirm if this is working?

[yogeshmahajan-1903]

An error while importing server.

[yogeshmahajan-1903]

This is working fine.