Branch: refs/heads/XWIKI-22942 Home: https://github.com/xwiki/xwiki-platform Commit: 9042d3481ee47d448eb3797943fc9a979b3918c8 https://github.com/xwiki/xwiki-platform/commit/9042d3481ee47d448eb3797943fc9... Author: Simon Urli <[email protected]> Date: 2026-09-17 (Thu, 17 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-handlers/xwiki-platform-extension-handler-xar/src/main/java/org/xwiki/extension/xar/internal/security/XarSecurityTool.java M xwiki-platform-core/xwiki-platform-oldcore/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/doc/DefaultDocumentAccessBridge.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/plugin/rightsmanager/UserIterator.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiRightService.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiUser.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/AbstractXWikiAuthService.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/AppServerTrustedAuthServiceImpl.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/AppServerTrustedKerberosAuthServiceImpl.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImpl.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/XWikiRightServiceImpl.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImplTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-api/pom.xml M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-api/src/main/java/org/xwiki/security/authorization/AuthorizationManager.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-api/src/test/java/org/xwiki/security/authorization/AbstractAuthorizationTestCase.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-api/src/test/java/org/xwiki/security/authorization/DefaultAuthorizationManagerTest.java M xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-checker/src/main/java/org/xwiki/test/checker/internal/ProgrammingRightCheckerAuthorizationManager.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-api/pom.xml M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-api/src/main/java/org/xwiki/user/SuperAdminUserReference.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-api/src/test/java/org/xwiki/user/SuperAdminUserReferenceTest.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/AbstractUserPropertiesResolver.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/DefaultUserManager.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/document/AbstractDocumentStringUserReferenceResolver.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/document/AbstractUserReferenceResolver.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/document/CurrentUserManager.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/document/DocumentDocumentReferenceUserReferenceResolver.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/document/DocumentDocumentReferenceUserReferenceSerializer.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/document/DocumentStringUserReferenceSerializer.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/main/java/org/xwiki/user/internal/document/UserPreferencesConfigurationSource.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-default/src/test/java/org/xwiki/user/internal/document/DocumentDocumentReferenceUserReferenceResolverTest.java M xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-resource/src/main/java/org/xwiki/user/resource/internal/ConfiguredUserResourceReferenceSerializer.java Log Message: ----------- XWIKI-22942: isSuperAdmin is implemented in many different ways * Make SuperAdminUserReference the single source of truth for the Super Admin user: add SUPERADMIN_USER_NAME, SUPERADMIN_USER_SPACE, SUPERADMIN_LOCAL_REFERENCE, isSuperAdmin(UserReference), isSuperAdminReference(EntityReference) and isSuperAdminName(String) * Only recognize XWiki.superadmin as the Super Admin user, i.e. check the space on top of the name everywhere a reference is available, and resolve a user document named superadmin outside of the XWiki space as an ordinary user reference * Make AuthorizationManager, XWikiRightService, XWikiUser, UserIterator, DefaultDocumentAccessBridge, AbstractXWikiAuthService, XWikiRightServiceImpl and the user reference resolvers and serializers all rely on SuperAdminUserReference rather than on their own comparison * Add AuthorizationManager#isSuperAdmin(UserReference) * Deprecate XWikiRightService#isSuperAdmin(EntityReference) * Resolve the user reference in ProgrammingRightCheckerAuthorizationManager rather than comparing it to InternalTemplateManager#SUPERADMIN_REFERENCE * Keep the name only rule for the authentication services, which compare a name resolved with the default document reference resolver * Check the superadmin name against the user name XWikiAuthServiceImpl actually looks up, which is not parsed out of the entered string the same way as the name the existing check compares * Do not take the superadmin user name from the application server in the trusted authentication services Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications