Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-25016

Broken comment line for the hashed superadmin password in xwiki.cfg

    XMLWordPrintable

Details

    • Unknown
    • N/A
    • N/A

    Description

      Problem

      XWIKI-22257 added support for a hashed value in the xwiki.superadminpassword property and documented it in the comment block shipped in xwiki.cfg. That comment block has two defects, both introduced by commit e5f6530c1ae.

      1. A comment line lost its "#-#" prefix

      In xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.cfg.vm (lines 305-307 at the time of writing), the sentence describing the new format is wrapped onto a second line that does not start with the comment marker:

      #-# [Since 18.8.0RC1] Instead of plain text password, you can use a hashed password string using
      the format {hashAlgorithm}hash where the hash algorithm is an algorithm supported by PasswordClass.
      #-# e.g., generated using htpasswd -bnBC 10 "" yourpassword | tr -d ':\n'
      

      XWikiConfig extends java.util.Properties (XWikiConfig.java:36) and loads the file with load (XWikiConfig.java:69), so that second line is not a comment. It is parsed as a property:

      key   = the
      value = format {hashAlgorithm}hash where the hash algorithm is an algorithm supported by PasswordClass.
      

      Every shipped xwiki.cfg therefore declares a bogus property, and an administrator reading the file sees a broken comment.

      Expected

      • Restore the "#-#" prefix on the wrapped line, so that no bogus property is declared.
      • Show the algorithm prefix in the example, for instance the resulting property line rather than the bare hash.

      Note

      Both defects are in code the unreleased 18.8.0-rc-1 introduces. Per the project convention this would normally be fixed by reopening XWIKI-22257; a separate issue was requested instead.

      Attachments

        Issue Links

          Activity

            People

              surli Simon Urli
              surli Simon Urli
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: