Details
-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
6.3-milestone-2, 6.2.3
-
Unknown
-
Description
Since XWIKI-5261 when you set or import a clear password in a XWikiDocument it's "salted".
This means that the following
{{groovy}}
doc1 = new com.xpn.xwiki.doc.XWikiDocument()
doc1.newObject('XWiki.XWikiUsers', xcontext.context)
doc2 = doc1.clone()
println doc1.equals(doc2)
password = "password"
doc1.getObject('XWiki.XWikiUsers').set('password', password, xcontext.context)
doc2.getObject('XWiki.XWikiUsers').set('password', password, xcontext.context)
println doc1.equals(doc2)
{{/groovy}}
now gives
true false
Same issue with a XWikiDocument you would import twice from a XAR containing clear passwords (this is what caused XE-1499).
Attachments
Issue Links
- is related to
-
XE-1499 Conflict on Admin user when upgrading from 6.4.4 to 7.1.1
-
- Closed
-
-
XWIKI-5261 Password hashes dumpable
-
- Closed
-