From e1d0e38057c8a9dddddda4e3e33a4a0fd9714243 Mon Sep 17 00:00:00 2001
From: Jonathan Jenne <j.jenne@digitaldata.works>
Date: Wed, 18 Aug 2021 10:54:10 +0200
Subject: [PATCH] Interfaces/ActiveDirectory: Better error handling in
 UpdateUser, Add Language Reference

---
 .../SyncUsers.MSSQL.vb                        | 22 ++++++++++++++++++-
 Modules.Interfaces/Interfaces.vbproj          |  4 ++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/Modules.Interfaces/ActiveDirectoryInterface/SyncUsers.MSSQL.vb b/Modules.Interfaces/ActiveDirectoryInterface/SyncUsers.MSSQL.vb
index 928201d0..b34ab6c7 100644
--- a/Modules.Interfaces/ActiveDirectoryInterface/SyncUsers.MSSQL.vb
+++ b/Modules.Interfaces/ActiveDirectoryInterface/SyncUsers.MSSQL.vb
@@ -1,5 +1,6 @@
 Imports DigitalData.Modules.Database
 Imports DigitalData.Modules.Logging
+Imports DigitalData.Modules.Language
 
 Namespace SyncUsers
     Public Class SyncUsersMSSQL
@@ -209,10 +210,24 @@ Namespace SyncUsers
 
         Private Function UpdateUser(User As ADUser) As Integer
             Try
+                If User Is Nothing Then
+                    _logger.Warn("Error in UpdateUser - User object is nothing")
+                    Return 0
+                End If
+
+                If User.samAccountName Is Nothing Then
+                    _logger.Warn("Error in UpdateUser - User samAccountName is nothing")
+                    Return 0
+                End If
+
                 Dim oUserId As Integer = GetUserId(User.samAccountName)
                 If Not IsNothing(oUserId) Then
                     If oUserId > 0 Then
-                        Dim oSQL As String = $"UPDATE TBDD_USER SET PRENAME = '{User.GivenName}', NAME = '{User.Surname.Replace("'", "''")}', EMAIL = '{User.Email.Replace("'", "''")}', CHANGED_WHO = '{ADDED_WHO}' WHERE GUID = {oUserId}"
+                        Dim oGivenName As String = EscapeQuotes(User.GivenName)
+                        Dim oSurname As String = EscapeQuotes(User.Surname)
+                        Dim oEmail As String = EscapeQuotes(User.Email)
+
+                        Dim oSQL As String = $"UPDATE TBDD_USER SET PRENAME = '{oGivenName}', NAME = '{oSurname}', EMAIL = '{oEmail}', CHANGED_WHO = '{ADDED_WHO}' WHERE GUID = {oUserId}"
                         Dim oResult = _mssql.ExecuteNonQuery(oSQL)
 
                         If oResult = True Then
@@ -234,6 +249,11 @@ Namespace SyncUsers
             End Try
         End Function
 
+        Private Function EscapeQuotes(pString As String)
+            Dim oString = Utils.NotNull(pString, String.Empty)
+            Return oString.Replace("'", "''")
+        End Function
+
         Public Sub AddCustomAttributesToUser(User As ADUser, UserId As Integer) Implements ISyncUsers.AddCustomAttributesToUser
             Dim oCustomAttributes = User.CustomAttributes
 
diff --git a/Modules.Interfaces/Interfaces.vbproj b/Modules.Interfaces/Interfaces.vbproj
index f8237cd2..8b9c838d 100644
--- a/Modules.Interfaces/Interfaces.vbproj
+++ b/Modules.Interfaces/Interfaces.vbproj
@@ -142,6 +142,10 @@
       <Project>{EAF0EA75-5FA7-485D-89C7-B2D843B03A96}</Project>
       <Name>Database</Name>
     </ProjectReference>
+    <ProjectReference Include="..\Modules.Language\Language.vbproj">
+      <Project>{d3c8cfed-d6f6-43a8-9bdf-454145d0352f}</Project>
+      <Name>Language</Name>
+    </ProjectReference>
     <ProjectReference Include="..\Modules.Logging\Logging.vbproj">
       <Project>{903B2D7D-3B80-4BE9-8713-7447B704E1B0}</Project>
       <Name>Logging</Name>