Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
6.2.3
-
Integration
-
Unknown
-
N/A
-
N/A
-
Description
The resetpassword feature has been broken by the salting of passwords implemented in XWIKI-5261
The verification of the string passed in the email is not working anymore.
The following velocity macro works instead:
#**
* Verify that the request parameters are valid.
* @param userName The user name (full document name) received in the URL.
* @param validationString The unencrypted key that is stored in the ResetPasswordRequestClass object.
* @param result A boolean where the validation result is returned. True if the request is valid, false otherwise.
*#
#macro(verifyRequest $userName $validationString $isValid)
#set ($isValid = false)
#if ($validationString != '' && $userName != '')
##encrypt($validationString $result)
##set ($encryptedValidationString = $result)
#set ($currentString = $!xwiki.getDocumentAsAuthor($userName).getObject($verifClass).getProperty('verification').getValue())
#set ($field = $xwiki.getClass($verifClass).getXWikiClass().get('verification'))
#set ($encryptedValidationString = $field.getEquivalentPassword($currentString, $validationString))
#if ($currentString == $encryptedValidationString)
#set ($isValid = true)
#end
#end
#end
The encrypt macro is not needed anymore
Attachments
Issue Links
- is related to
-
XWIKI-5261 Password hashes dumpable
-
- Closed
-