server/AyaNova/DataList/InsideUserDataList.cs

@@ -13,7 +13,7 @@ namespace AyaNova.DataList
             SQLFrom = "from auser left join avendor on (auser.vendorid=avendor.id)";
             var RoleSet = BizRoles.GetRoleSet(DefaultListObjectType);
             AllowedRoles = RoleSet.ReadFullRecord | RoleSet.Change;
-            DefaultColumns = new List<string>() { "name", "employeenumber", "active", "usertype", "lastlogin", "roles" };
+            DefaultColumns = new List<string>() { "name", "employeenumber", "active", "usertype", "lastlogin" };
             DefaultSortBy = new Dictionary<string, string>() { { "name", "+" } };
 
             FieldDefinitions = new List<DataListFieldDefinition>();

server/AyaNova/biz/UserBiz.cs

@@ -384,9 +384,11 @@ namespace AyaNova.Biz
 
             putObject.Tags = TagBiz.NormalizeTags(putObject.Tags);
             putObject.CustomFields = JsonUtil.CompactJson(putObject.CustomFields);
-            await ValidateAsync(putObject, dbObject);
-            if (HasErrors) return null;
-            var OriginalSalt = dbObject.Salt;
+
+            //the salt is not sent with the put object, it's only location is in the db and since this putObject is replacing the dbObject
+            //we need to set it again here
+            putObject.Salt = dbObject.Salt;
+            
             var OriginalPW = dbObject.Password;
             var OriginalLogin = dbObject.Login;
             ct.Replace(dbObject, putObject);
@@ -395,13 +397,12 @@ namespace AyaNova.Biz
             if (!string.IsNullOrWhiteSpace(putObject.Password))
             {
                 //YES password is being updated:                
-                putObject.Password = Hasher.hash(OriginalSalt, putObject.Password);
+                putObject.Password = Hasher.hash(putObject.Salt, putObject.Password);
             }
             else
             {
                 //No, use the snapshot password value
-                putObject.Password = OriginalPW;
-                putObject.Salt = OriginalSalt;
+                putObject.Password = OriginalPW;               
             }
             //Updating login?
             if (string.IsNullOrWhiteSpace(putObject.Login))
@@ -409,6 +410,10 @@ namespace AyaNova.Biz
                 //No, use the original value
                 putObject.Login = OriginalLogin;
             }
+
+            await ValidateAsync(putObject, dbObject);
+            if (HasErrors) return null;
+
             try
             {
                 await ct.SaveChangesAsync();