What the developer wrote
Authored by monasco
fix notfound (#7572)
What changed, and why it matters
This commit changes how BTCPay Server handles a missing user when an administrator tries to resend a verification email. Previously, the code threw a generic internal error (ApplicationException), which could expose internal details or produce an unhandled error page. Now it returns a clean 'Not Found' response. This is a hardening fix: it improves error handling and reduces information leakage, but it does not by itself grant an attacker new capabilities.
Treat as a minor hardening improvement. Review whether the caller/admin UI handles the 404 gracefully. No urgent patching required solely on the basis of this diff, but include in the next maintenance release.
Security signals we found
Replaces thrown ApplicationException with NotFound() for missing user
Reduces information leakage via exception message containing userId
Improves HTTP semantics (404 instead of 500-class error)
No authentication or authorization logic changed
Evidence from the diff
In UIServerController.Users.cs, the SendVerificationEmailPost action previously threw ApplicationException when the supplied userId did not resolve to a user. The patch replaces the exception with return NotFound(). This converts an unhandled/internal-error path into a proper HTTP 404 response, eliminating a potential information-disclosure vector (the exception message included the user ID) and improving robustness. There is no evidence in the diff of authentication bypass, authorization weakness, or direct exploitability.
Changed components
BTCPayServer/Controllers/UIServerController.Users.csSendVerificationEmailPost actionInspect captured patch +1 / −3
### BTCPayServer/Controllers/UIServerController.Users.cs
@@ -455,9 +455,7 @@ public async Task<IActionResult> SendVerificationEmailPost(string userId)
{
var user = await _UserManager.FindByIdAsync(userId);
if (user == null)
- {
- throw new ApplicationException($"Unable to load user with ID '{userId}'.");
- }
+ return NotFound();
var callbackUrl = await _callbackGenerator.ForEmailConfirmation(user);
_eventAggregator.Publish(new UserEvent.ConfirmationEmailRequested(user, callbackUrl));Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.