Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
18.8.0-rc-1
-
Unknown
-
N/A
-
N/A
-
Description
Problem
XWIKI-22257 added support for a hashed value in the xwiki.superadminpassword property and documented it in the comment block shipped in xwiki.cfg. That comment block has two defects, both introduced by commit e5f6530c1ae.
1. A comment line lost its "#-#" prefix
In xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.cfg.vm (lines 305-307 at the time of writing), the sentence describing the new format is wrapped onto a second line that does not start with the comment marker:
#-# [Since 18.8.0RC1] Instead of plain text password, you can use a hashed password string using
the format {hashAlgorithm}hash where the hash algorithm is an algorithm supported by PasswordClass.
#-# e.g., generated using htpasswd -bnBC 10 "" yourpassword | tr -d ':\n'
XWikiConfig extends java.util.Properties (XWikiConfig.java:36) and loads the file with load (XWikiConfig.java:69), so that second line is not a comment. It is parsed as a property:
key = the
value = format {hashAlgorithm}hash where the hash algorithm is an algorithm supported by PasswordClass.
Every shipped xwiki.cfg therefore declares a bogus property, and an administrator reading the file sees a broken comment.
Expected
- Restore the "#-#" prefix on the wrapped line, so that no bogus property is declared.
- Show the algorithm prefix in the example, for instance the resulting property line rather than the bare hash.
Note
Both defects are in code the unreleased 18.8.0-rc-1 introduces. Per the project convention this would normally be fixed by reopening XWIKI-22257; a separate issue was requested instead.
Attachments
Issue Links
- is caused by
-
XWIKI-22257 Hash the superadmin password
-
- Closed
-