There is 1 update, 2 comments.
 
 
XWiki Platform / cid:jira-generated-image-avatar-4b08bbe5-68f4-41d9-ad74-163583fa3713 XWIKI-12561 Open

Can't compare two XWikiDocument with password property initialized with a clear password anymore

 
View issue   ยท   Add comment
 

1 update

 
cid:jira-generated-image-avatar-ed8460e5-1d76-4810-97a1-736216a81523 Changes by Simon Urli on 15/Oct/26 11:03
 
Assignee: Simon Urli
 
 

2 comments

 
cid:jira-generated-image-avatar-e74e89ad-e701-4ea0-91fb-647b20b44357 Manuel Leduc on 15/Oct/26 11:01
 

Closing this issue as won't fix was rediscussed in the chat (https://matrix.to/#/!zdPfnFC0pUfwN5kZ4LKP2dXZ2jC266yFWKNeqgmJd4E/$4eIQnJvA23Zl_d8s5xaP4GD-ItC-KW-5j_D-z7Zxth0?via=matrix.xwiki.com&via=matrix.org&via=helsinki-systems.de)
The conclusion is that this issue shouldn't be close as it raises important question about how to compare passwords, that must be discussed further first.

 
cid:jira-generated-image-avatar-ed8460e5-1d76-4810-97a1-736216a81523 Simon Urli on 15/Oct/26 11:08
 

So there is a real regression related to the fact that passwords are contained in pages and so having the comparison returning false lead to merge conflicts when upgrading extensions that contains passwords.
In general I believe we shouldn't compare the password values at all when performing equality checks of pages: it's possible that now we migrated password to their own property class and we don't rely anymore to StringClass it's easier to filter them out.
However we also need to ensure that saving objects with a password without changing its value won't suddenly randomly override it, and in the contrary that it's still possible to change their value through object editor.

So we need to be careful where the equality works and where it doesn't and we probably need to review the APIs we're using to set password values.