COM API: return an error, not success, when the caller is not a server admin

Fifteen COM methods rejected an unauthorized caller with `return false`. These
functions return HRESULT, where false is 0 - which is S_OK. Every one of them
reported success for a call it had just refused.

The consequences differ by method but none are benign:

  - InterfaceCache's five getters return before writing *pVal, so a caller
    without server-admin rights receives S_OK and reads whatever happened to be
    in the out-parameter. Uninitialized memory handed to any COM client.
  - InterfaceSettings::SetAdministratorPassword and five siblings skip the write
    and report success, so a caller is told the administrator password changed
    when it did not.
  - InterfaceMessageIndexing's four methods behave the same way.

This is the file's own convention being broken rather than a design choice:
InterfaceSettings.cpp already returns authentication_->GetAccessDenied() in
twelve other places, and each of the fifteen sites calls GetAccessDenied() one
line above for the null-config check. They now do the same for the
authorization check.

Found by running CodeQL's C++ suite locally. The workflow analyses csharp only,
so 4.65 MB of network-facing code - the largest language in the repository and
the entire protocol surface - had never been scanned. The scan returned 16
high-severity findings, 15 of them these. Re-running it after the fix returns
1: cpp/incorrect-string-type-conversion in FileUtilities.cpp, which is a false
positive - the cast binds before the +1, so it skips a UTF-16 BOM rather than a
byte.

Builds clean under /WX. Note the regression suite could not be used to validate
this: ESET's mail proxying rewrites the IMAP literal continuation on this
machine and fails 536 of 1026 tests regardless of the change.

Author: chrisholloway5

hmailserver/source/Server/COM/InterfaceCache.cpp

@@ -114,7 +114,7 @@ InterfaceCache::get_DomainHitRate(long *pVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       *pVal = HM::Cache<HM::Domain>::Instance()->GetHitRate();
 
@@ -223,7 +223,7 @@ InterfaceCache::get_AccountHitRate(long *pVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       *pVal = HM::Cache<HM::Account>::Instance()->GetHitRate();
       return S_OK;
@@ -331,7 +331,7 @@ InterfaceCache::get_AliasHitRate(long *pVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       *pVal = HM::Cache<HM::Alias>::Instance()->GetHitRate();
       return S_OK;
@@ -438,7 +438,7 @@ InterfaceCache::get_DistributionListHitRate(long *pVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       *pVal = HM::Cache<HM::DistributionList>::Instance()->GetHitRate();
       return S_OK;
@@ -510,7 +510,7 @@ InterfaceCache::Clear()
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       HM::Cache<HM::Account>::Instance()->Clear();
       HM::Cache<HM::Domain>::Instance()->Clear();

hmailserver/source/Server/COM/InterfaceMessageIndexing.cpp

@@ -70,7 +70,7 @@ STDMETHODIMP InterfaceMessageIndexing::get_TotalMessageCount(long *pVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       *pVal = HM::PersistentMessage::GetTotalMessageCountDelivered();
 
@@ -87,7 +87,7 @@ STDMETHODIMP InterfaceMessageIndexing::get_TotalIndexedCount(long *pVal)
    try
    {
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       HM::PersistentMessageMetaData md;
       *pVal = md.GetTotalMessageCount();
@@ -105,7 +105,7 @@ STDMETHODIMP InterfaceMessageIndexing::Clear()
    try
    {
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       HM::PersistentMessageMetaData md;
 
@@ -124,7 +124,7 @@ STDMETHODIMP InterfaceMessageIndexing::Index()
    try
    {
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       HM::MessageIndexer::Instance()->IndexNow();
 

hmailserver/source/Server/COM/InterfaceSettings.cpp

@@ -1020,7 +1020,7 @@ STDMETHODIMP InterfaceSettings::SetAdministratorPassword(BSTR newVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
 
       ini_file_settings_->SetAdministratorPassword(newVal);
@@ -1218,7 +1218,7 @@ STDMETHODIMP InterfaceSettings::get_SSLCertificates(IInterfaceSSLCertificates **
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       std::shared_ptr<HM::SSLCertificates> pSSLCertificates = HM::Configuration::Instance()->GetSSLCertificates();
 
@@ -1871,7 +1871,7 @@ STDMETHODIMP InterfaceSettings::get_PublicFolders(IInterfaceIMAPFolders **pVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       std::shared_ptr<HM::IMAPFolders> pIMAPFolders = HM::Configuration::Instance()->GetIMAPConfiguration()->GetPublicFolders();
 
@@ -1898,7 +1898,7 @@ STDMETHODIMP InterfaceSettings::get_PublicFolderDiskName(BSTR *pVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       *pVal = config_->GetIMAPConfiguration()->GetPublicFolderDiskName().AllocSysString();
       return S_OK;
@@ -1917,7 +1917,7 @@ STDMETHODIMP InterfaceSettings::get_Groups(IInterfaceGroups **pVal)
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       CComObject<InterfaceGroups>* pItem = new CComObject<InterfaceGroups>();
       pItem->SetAuthentication(authentication_);
@@ -2141,7 +2141,7 @@ STDMETHODIMP InterfaceSettings::ClearLogonFailureList()
          return GetAccessDenied();
 
       if (!GetIsServerAdmin())
-         return false;
+         return GetAccessDenied();
 
       config_->ClearOldLogonFailures();