Branch: refs/heads/stable-17.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 6f6f6e27ee5a4f4e7e21634fde53cf4ed0580220 https://github.com/xwiki/xwiki-platform/commit/6f6f6e27ee5a4f4e7e21634fde53c... Author: Simon Urli <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M pom.xml M xwiki-platform-core/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiUsersDocumentInitializer.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseCollection.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PasswordClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/meta/PasswordMetaClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImpl.java A xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/migration/R171014001XWIKI24357DataMigration.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/objects/PasswordPropertyParser.java A xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoder.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/resources/META-INF/components.txt M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/BaseCollectionTest.java A xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/PasswordClassTest.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImplTest.java A xwiki-platform-core/xwiki-platform-oldcore/src/test/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoderTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManager.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManagerTest.java M xwiki-platform-distribution/xwiki-platform-distribution-ui/xwiki-platform-distribution-ui-admin-user/src/main/resources/XWiki/Admin.xml Log Message: ----------- XWIKI-24357: Improve PasswordClass hash algorithm (#6633) Refactor PasswordClass to rely on Spring Security framework algorithms, format and PasswordEncoder interface. Those changes also provide a migration to re-encode existing passwords in DB with a stronger algorithm. * All previous algorithm for password hash computation in PasswordClass has been moved to the new XWikiLegacyPasswordEncoder which implements the PasswordEncoder interface provided by Spring Security: the same encoder is also used to re-encode the passwords in the migration * I simplified the API for checking if 2 passwords are matching by providing utility methods that allows to perform the check directly at an XObject level, without having to get the class property perform a cast etc * Most changes are obviously in PasswordClass where I added the support of the different algorithm and provided the logic to support both legacy and new formats, and added checks to issue warning when legacy or deprecated encodings are used (cherry picked from commit 25305cb0ef73968465529ed307dda66a249fab2d) (cherry picked from commit 15cfa89ec9d50d7f84d5c812b2a663309ee6bfb0) * Add missing dependency exclusion (cherry picked from commit 60c507c198727ddec28e35fabeebad610294fe1c) * Add a unit test for BaseCollection#isPasswordValueMatching covering a clear value stored in a StringProperty * Add a unit test for XWiki#validateUser covering an empty validation key * Add missing check for empty passwords * Ensure to have case sensitive check for clear passwords (cherry picked from commit 0ea39140592b326cfd5e230f239fd1eed1ca7f7d) (cherry picked from commit 1c27a84317ecbc463f0ba1a18a2f8fc56c46908c) * Fix regression with handling placeholder * Provide tests (cherry picked from commit fa3cc8ad5b87ca2800ded0322ef827d5ecf0f29a) (cherry picked from commit 3da7ac27d703a87de223942c2fe802b805147d50) * Prevent logging warnings and errors when the XWikiLegacyPasswordEncoder is used (cherry picked from commit b79d54a537151bc2954eae5c9dd295d6ca6df6a5) (cherry picked from commit 40796d1a0d3f147e0871939ef29988d71eae4e1f) * Add `@since 17.10.14` for the backported APIs * Replace the `@since 17.10.13` and `@since 16.10.19` of XWikiLegacyPasswordEncoder, which were never released on those branches, by `@since 17.10.14` --------- Co-authored-by: Vincent Massol <[email protected]> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications