Branch: refs/heads/backport/stable-17.10.x/XWIKI-24357 Home: https://github.com/xwiki/xwiki-platform Commit: 9e5ee7b796b127dcaec6d7bea2de973b45b2c384 https://github.com/xwiki/xwiki-platform/commit/9e5ee7b796b127dcaec6d7bea2de9... Author: Simon Urli <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M pom.xml M xwiki-platform-core/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiUsersDocumentInitializer.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseCollection.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PasswordClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/meta/PasswordMetaClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImpl.java A xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/migration/R171014001XWIKI24357DataMigration.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/objects/PasswordPropertyParser.java A xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoder.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/resources/META-INF/components.txt M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImplTest.java A xwiki-platform-core/xwiki-platform-oldcore/src/test/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoderTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManager.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManagerTest.java M xwiki-platform-distribution/xwiki-platform-distribution-ui/xwiki-platform-distribution-ui-admin-user/src/main/resources/XWiki/Admin.xml Log Message: ----------- XWIKI-24357: Provide new algorithms in PasswordClass Refactor PasswordClass to rely on Spring Security framework algorithms, format and PasswordEncoder interface. Those changes also provide a migration to re-encode existing passwords in DB with a stronger algorithm. * All previous algorithm for password hash computation in PasswordClass has been moved to the new XWikiLegacyPasswordEncoder which implements the PasswordEncoder interface provided by Spring Security: the same encoder is also used to re-encode the passwords in the migration * I simplified the API for checking if 2 passwords are matching by providing utility methods that allows to perform the check directly at an XObject level, without having to get the class property perform a cast etc * Most changes are obviously in PasswordClass where I added the support of the different algorithm and provided the logic to support both legacy and new formats, and added checks to issue warning when legacy or deprecated encodings are used (cherry picked from commit 25305cb0ef73968465529ed307dda66a249fab2d) (cherry picked from commit 15cfa89ec9d50d7f84d5c812b2a663309ee6bfb0) Commit: dd37e098994ce9f0c8e945c375427c8484ea445a https://github.com/xwiki/xwiki-platform/commit/dd37e098994ce9f0c8e945c375427... Author: Simon Urli <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/pom.xml Log Message: ----------- XWIKI-24357: Provide new algorithms in PasswordClass * Add missing dependency exclusion (cherry picked from commit 60c507c198727ddec28e35fabeebad610294fe1c) Commit: 1986f9c2628ced1f4ad6bdd332bbcc498a04c433 https://github.com/xwiki/xwiki-platform/commit/1986f9c2628ced1f4ad6bdd332bbc... Author: Vincent Massol <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseCollection.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/BaseCollectionTest.java Log Message: ----------- XWIKI-25027: Regressions in the PasswordClass hash algorithm rework * Add a unit test for BaseCollection#isPasswordValueMatching covering a clear value stored in a StringProperty * Add a unit test for XWiki#validateUser covering an empty validation key * Add missing check for empty passwords * Ensure to have case sensitive check for clear passwords Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Co-Authored-By: Simon Urli <[email protected]> (cherry picked from commit 0ea39140592b326cfd5e230f239fd1eed1ca7f7d) (cherry picked from commit 1c27a84317ecbc463f0ba1a18a2f8fc56c46908c) Commit: 944395cc6e78819a6cae24ac31a2d697b2f1c507 https://github.com/xwiki/xwiki-platform/commit/944395cc6e78819a6cae24ac31a2d... Author: Simon Urli <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PasswordClass.java A xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/PasswordClassTest.java Log Message: ----------- XWIKI-25027: Regressions in the PasswordClass hash algorithm rework * Fix regression with handling placeholder * Provide tests (cherry picked from commit fa3cc8ad5b87ca2800ded0322ef827d5ecf0f29a) (cherry picked from commit 3da7ac27d703a87de223942c2fe802b805147d50) Commit: efe0be75bf91de0d822a2a7550b9cd46d200df7e https://github.com/xwiki/xwiki-platform/commit/efe0be75bf91de0d822a2a7550b9c... Author: Simon Urli <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoder.java Log Message: ----------- XWIKI-25027: Regressions in the PasswordClass hash algorithm rework * Prevent logging warnings and errors when the XWikiLegacyPasswordEncoder is used (cherry picked from commit b79d54a537151bc2954eae5c9dd295d6ca6df6a5) (cherry picked from commit 40796d1a0d3f147e0871939ef29988d71eae4e1f) Commit: 62fcd08666b1092bb86be6ce3bbc5b0011b7a191 https://github.com/xwiki/xwiki-platform/commit/62fcd08666b1092bb86be6ce3bbc5... Author: Simon Urli <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiUsersDocumentInitializer.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseCollection.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PasswordClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoder.java Log Message: ----------- XWIKI-24357: Improve PasswordClass hash algorithm * Add `@since 17.10.14` for the backported APIs * Replace the `@since 17.10.13` and `@since 16.10.19` of XWikiLegacyPasswordEncoder, which were never released on those branches, by `@since 17.10.14` Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Compare: https://github.com/xwiki/xwiki-platform/compare/9e5ee7b796b1%5E...62fcd08666... To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications