Problem XWIKI-22257 added support for a hashed value in the xwiki.superadminpassword property and documented it in the comment block shipped in xwiki.cfg. That comment block has two defects, both introduced by commit e5f6530c1ae.
1. A comment line lost its "#-#" prefix In xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.cfg.vm (lines 305-307 at the time of writing), the sentence describing the new format is wrapped onto a second line that does not start with the comment marker:
#-# [Since 18.8.0RC1] Instead of plain text password, you can use a hashed password string using
the format {hashAlgorithm}hash where the hash algorithm is an algorithm supported by PasswordClass.
#-# e.g., generated using htpasswd -bnBC 10 "" yourpassword | tr -d ':\n'
XWikiConfig extends java.util.Properties (XWikiConfig.java:36) and loads the file with load (XWikiConfig.java:69), so that second line is not a comment. It is parsed as a property:
Every shipped xwiki.cfg therefore declares a bogus property, and an administrator reading the file sees a broken comment. 2. The htpasswd example omits the required algorithm prefix The example produces a bare bcrypt hash:
A value is only treated as a hash when it starts with the algorithm key between braces (AbstractXWikiAuthService.java:55-58). A bare hash does not match that pattern, so it falls through to the plain text comparison (AbstractXWikiAuthService.java:115) and authentication silently fails. The line above does give the format, but the example should show the prefix the value needs. Expected
- Restore the "#-#" prefix on the wrapped line, so that no bogus property is declared.
- Show the algorithm prefix in the example, for instance the resulting property line rather than the bare hash.
Note Both defects are in code the unreleased 18.8.0-rc-1 introduces. Per the project convention this would normally be fixed by reopening XWIKI-22257; a separate issue was requested instead. |
