Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
18.4.6, 18.8.0
-
Windows 11 Pro, Firefox 157, using an instance of XWiki 18.4.6 on Oracle 19c, Tomcat 11, and Jetty/HSQL
-
Unit
-
Unknown
-
N/A
-
N/A
-
Description
Steps to reproduce
- Create an older instance of XWiki (I've reproduced with 12.10.11 and 13.4.7)
- Upgrade this instance to XWiki 18.4.6 (by copying the "data" folder to the new instance's folder - on Jetty for ex.)
- To better reproduce the issue, if already logged in with Admin, start the 18.4.6 instance on a different port (the idea is to login after starting the instance, or just logout and re-login after upgrade)
- After the 18.4.6 instance is started, login with Admin
- Observe the logs
Expected results
No error are displayed.
Actual results
The following error is displayed:
2026-10-07 15:19:50,456 [http-nio-1115-exec-8 - http://localhost:1115/xwiki/bin/loginsubmit/XWiki/XWikiLogin] ERROR c.x.x.o.c.PasswordClass - An outdated algorithm [XWikiLegacy] (or an outdated version of it) is used in a PasswordClass property not yet attached to an object java.lang.Exception at com.xpn.xwiki.objects.classes.PasswordClass.warnAboutOutdatedAlgorithm(PasswordClass.java:473) at com.xpn.xwiki.objects.classes.PasswordClass.arePasswordsMatching(PasswordClass.java:443) at com.xpn.xwiki.objects.BaseCollection.isPasswordValueMatching(BaseCollection.java:684) at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.checkPassword(XWikiAuthServiceImpl.java:450) at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.authenticate(XWikiAuthServiceImpl.java:379) at org.xwiki.security.authservice.internal.StandardXWikiAuthServiceComponent.authenticate(StandardXWikiAuthServiceComponent.java:81) at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.authenticate(MyFormAuthenticator.java:292) at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.processLogin(MyFormAuthenticator.java:213) at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.processLogin(MyFormAuthenticator.java:195) at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.checkAuth(XWikiAuthServiceImpl.java:203) at org.xwiki.security.authservice.internal.StandardXWikiAuthServiceComponent.checkAuth(StandardXWikiAuthServiceComponent.java:62) at com.xpn.xwiki.XWiki.checkAuth(XWiki.java:4413) at org.xwiki.security.authorization.internal.XWikiCachingRightService.authenticateUser(XWikiCachingRightService.java:238) at org.xwiki.security.authorization.internal.XWikiCachingRightService.checkAccess(XWikiCachingRightService.java:268) at com.xpn.xwiki.XWiki.checkAccess(XWiki.java:4436) at com.xpn.xwiki.XWiki.prepareDocuments(XWiki.java:6014) at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:548) at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:339) at com.xpn.xwiki.web.LegacyActionServlet.service(LegacyActionServlet.java:111) at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:132) at com.xpn.xwiki.web.ActionFilter.doFilter(ActionFilter.java:123) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.xwiki.wysiwyg.filter.ConversionFilter.doFilter(ConversionFilter.java:71) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:59) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.xwiki.container.servlet.filters.internal.SetHTTPHeaderFilter.doFilter(SetHTTPHeaderFilter.java:66) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.xwiki.resource.servlet.RoutingFilter.doFilter(RoutingFilter.java:135) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.xwiki.container.servlet.filters.internal.SavedRequestRestorerFilter.doFilter(SavedRequestRestorerFilter.java:240) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.xwiki.container.servlet.filters.internal.SafeRedirectFilter.doFilter(SafeRedirectFilter.java:106) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.xwiki.container.servlet.filters.internal.ResolveRelativeRedirectFilter.doFilter(ResolveRelativeRedirectFilter.java:129) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.xwiki.container.servlet.filters.internal.SourceURLResolverFilter.doFilter(SourceURLResolverFilter.java:177) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.xwiki.container.servlet.filters.internal.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:120) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:77) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:540) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:86) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:782) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:71) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:347) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:71) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1307) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:2201) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:74) at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:949) at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:483) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:74) at java.base/java.lang.Thread.run(Thread.java:1474)
The upgrade, however, if being finished. But it seems the error occurs each time the Admin logins.
The issue could be reproduced on Jetty Standalone (with 12.10.11) and on Tomcat 11 (with 13.4.7 on Oracle 19c) and could not be reproduced when upgrading to XWiki 18.4.5.
Attachments
Issue Links
- is caused by
-
XWIKI-24357 Improve PasswordClass hash algorithm
-
- Closed
-
- relates to
-
XWIKI-25203 XWikiCacheStoreInterface#flushCache should always be called after a migration
-
- Closed
-