|
| Summary: |
Broken comment line and misleading example for the hashed superadmin password in xwiki.cfg |
| Description: |
h2. Problem
XWIKI-22257 added support for a hashed value in the {{xwiki.superadminpassword}} property and documented it in the comment block shipped in {{xwiki.cfg}}. That comment block has two defects, both introduced by commit e5f6530c1ae.
h3. 1. A comment line lost its "#-#" prefix
In {{xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.cfg.vm}} (lines 305-307 at the time of writing), the sentence describing the new format is wrapped onto a second line that does not start with the comment marker:
{code}
#-# [Since 18.8.0RC1] Instead of plain text password, you can use a hashed password string using
the format {hashAlgorithm}hash where the hash algorithm is an algorithm supported by PasswordClass.
#-# e.g., generated using htpasswd -bnBC 10 "" yourpassword | tr -d ':\n'
{code}
{{XWikiConfig}} extends {{java.util.Properties}} (XWikiConfig.java:36) and loads the file with {{load}} (XWikiConfig.java:69), so that second line is not a comment. It is parsed as a property:
{noformat}
key = the
value = format {hashAlgorithm}hash where the hash algorithm is an algorithm supported by PasswordClass.
{noformat}
Every shipped {{xwiki.cfg}} therefore declares a bogus property, and an administrator reading the file sees a broken comment.
h3. 2. The htpasswd example omits the required algorithm prefix
The example produces a bare bcrypt hash:
{noformat}
htpasswd -bnBC 10 "" yourpassword | tr -d ':\n'
{noformat}
A value is only treated as a hash when it starts with the algorithm key between braces (AbstractXWikiAuthService.java:55-58). A bare hash does not match that pattern, so it falls through to the plain text comparison (AbstractXWikiAuthService.java:115) and authentication silently fails. The line above does give the format, but the example should show the prefix the value needs.
h2. Expected
* Restore the "#-#" prefix on the wrapped line, so that no bogus property is declared.
* Show the algorithm prefix in the example, for instance the resulting property line rather than the bare hash.
h2. Note
Both defects are in code the unreleased 18.8.0-rc-1 introduces. Per the project convention this would normally be fixed by reopening XWIKI-22257; a separate issue was requested instead. |
|
