- xwiki-devs@xwiki.org - lists.xwiki.org

XWiki Google Summer of Code 2007
by Vincent Massol 26 Apr '07

26 Apr '07

Hello XWiki Summer-of-Coders 2007, First of all, thank you for showing your interest in Open Source development, and for choosing XWiki as the project which will get you acquainted with this kind of development. [For all xwiki community members who don't know what the summer of code is, check XWiki's SOC page on http://www.xwiki.org/xwiki/bin/ view/GoogleSummerOfCode/] The goal of the Summer of Code program is to introduce young students like you in the fantastic world of Open Source. If you only view this as a better paid summer job, then you can't be any more wrong. Our mission, as your mentors, is to ease your understanding of how things work, to help you learn new things you won't be thought in school, to integrate you in a large and very friendly community, and to help you understand how a very large project is managed, planned, developed. Open Source is not only about the code. It is more about the Community that participates in the development of the code. We, the mentors, will do our best to introduce you in this community and make you enjoy being part of it, so that when the summer ends, and all your obligations as soc-ers cease to exist, you will want to continue being part of our community. The most successful example is that of Sergiu, who was a SoC student like you last year, and now is a mentor for two of the accepted projects. Your job is a bit more difficult. You have to catch up with hundreds of thousands of lines of code, learn about so many new technologies, get used to a whole new way of working on a project, get used to the many rules regarding project development that make it survive the competition and become famous, AND write a not-so-simple new component for XWiki. We know this is a difficult task to achieve in less than 4 months, especially on your own, so we are willing to offer any help we can provide. So, let's get started. 1. We need to know what your main email address is (the one you check more often), so that we can reach you faster when needed. 2. We need to establish some rules regarding how you will interact with the mentors and the community, and how you will develop your code. First and foremost, working on XWiki needs to be fun and a good learning process! However the XWiki project is already following some development rules that we're asking SoC students to follow too. This is for the good of the XWiki project but more importantly it's a good way to learn how an open source community works and if these practices are followed then it'll be much easier to integrate the SoC student work into XWiki's official releases. So here are some practices we'd like SoC students to follow (please comment on the list if you'd like to change some of them or propose other things): * SoC students should be considered like any XWiki contributor which means they should respect the same rules and which means they are not committers on XWiki core. Note that a SoC student can become a Committer in the same manner a contributor can become one. * SoC students will be given commit access to the sandbox only, where they'll create their project (one top level directory for each project). For projects which need to modify some existing code, JIRA issues will need to be created and patches attached. It's important that patches be of good quality and small in order to be applied quickly. Once sandbox projects reach a good level of maturity (meaning they work and the code is of code quality, documented, etc) then we'd like to migrate them to the main release tree. * SoC students should obey all Community rules. For example this means: o using the XWiki coding conventions o using the defined communication channels: IRC and mailing list * SoC students have time allocated to familiarize with XWiki development process. As such we'd like each SoC student to pick one or several existing issues in JIRA and send a patch that fixes it/ them before that period ends (from 12th of April to 28th of May) This is a critical integration step to ensure all SoC students understand how XWiki works and it's a chance to start asking questions and get to know each other. * SoC student should post a quick introduction on the xwiki dev mailing list to explain who they are and what they're going to work on. * SoC student should always go to the list when communicating about their project. They should use the XWiki IRC channel if they need to talk to their mentors. The goal is that everyone in the XWiki community help them, answer their questions, but also know what they are doing. This will make patch applications and integration of their work back into XWiki trunk easier later on. This is very important and a criteria of success for the student. This is about learning how open source works. Note that students can also CC their mentor's email address if they want, but the mails have to go to the XWiki dev list. * SoC students should not block on anything for a long period of time. They should ask plenty of questions on the list (but they should also be autonomous!) These practices are also listed on http://www.xwiki.org/xwiki/bin/ view/GoogleSummerOfCode/ 3. Here's what you need to do to get you started: a) You need to register on http://forge.objectweb.org/account/ register.php ObjectWeb (or the OW2 Consortium, as it is known now) is an Open Source software community, and XWiki is one of the many projects belonging to this large "family". Mainly, it offers the same facilities Sourceforge offers. This is where the source code is hosted, and where the official mailing lists are hosted. You have to remember the username and password, because later you will use them for commiting code. b) You should subscribe to some of the mailing lists on http:// forge.objectweb.org/mail/?group_id=170 . We recommend that you subscribe at least to xwiki-dev and xwiki-users. c) You need to register on http://jira.xwiki.org/jira/secure/Signup! default.jspa This is where the code management takes place. It is a repository of known bugs, issues, planned new features or improvements. It also offers some statistics and roadmaps regarding the project evolution. Getting accustomed to using JIRA is a requirement. d) Download the XWiki source code. Follow the instructions on http:// www.xwiki.org/xwiki/bin/view/Community/SourceRepository For the moment, you can only checkout the code using anonymous access. e) It will be very hard to understand the code by reverse engineering. We know that the documentation is not our strong point (on the contrary), but reading the guides on http://www.xwiki.org/ xwiki/bin/view/Main/Documentation will help a lot. f) Try to follow the discussions on JIRA and on the mailing lists. We do know that you still have classes and exams, and we definitely don't want you to disregard school, so take things easy, and don't panic if something seems too difficult. Don't be shy, Open Source communities are about communications and help. Good luck, -The XWiki SOC mentor team (Sergiu, Jeremi, Ludovic, Jean-Vincent, Vincent)

4 6

[ANN] XWiki 1.0 RC 2 Released
by Vincent Massol 25 Apr '07

25 Apr '07

The XWiki development team team is pleased to announce the availability of the 1.0 RC 2 release. Go grab it on http://www.xwiki.org/xwiki/bin/view/Main/Download This release is planned to the last before the final 1.0 release (unless we find some important bugs in which case there'll be a RC3 release). The 1.0 release is still planned for end of April. New in this release: * Several important bugs fixed: o PDF generation fails if a header text is repeated due to TOC numbering in headings o Filter conflict: external links can be rendered two times o Generated heading id-s are not unique o Save & Continue button switches you from the Global Rights tab to the Preferences tab o Levels and Users properties are saved with an extra empty value o Fail to import a XAR exported with history o Calling $xwiki.refreshLinks() do not seem to generate backlinks for all pages o XML content inside {code} macro is rendered in the WYSIWYG editor o Bug when deleting attachment with accent with XWiki in UTF-8 encoding o Empty groups on XWiki.XWikiAllGroup, XWiki.XWikiAdminGroup and XWiki.XWikiGroupTemplate o Empty rights in Global Rights and in some spaces o Missing PDF templates for new PDF export configuration feature o Edition of a user do not show empty fields any more o Only if in the style macro has icon parameter then apply stylemacro class for the default value of class parameter.(to show icon image) o Do not display the register link if the current user do not have the register right o Global access levels are displayed in the local rights editor o The editor (wiki and wysiwyg) textarea in new skin don't fill 100% the editor panel o Cannot create pages with non ASCII characters in the XWiki standalone distribution * Document that importing documents will replace the existing versions and specially explain how to import XWiki user documents * Improve documentation for the Attachment and Skins pages of the User Guide IMPORTANT: XWiki 1.0 RC 2 fixes an important security issue in past releases where passwords were stored in clear in the database. Passwords are now hashed. If you are upgrading from a previous version, any new user or any password update will automatically get the password hashed. However existing users who do not change their passwords will still have their passwords in clear in the database. Thus, we are providing a tool to automatically hash all passwords from an existing database. See the full release notes on http://www.xwiki.org/xwiki/bin/view/ Main/ReleaseNotesXWiki10RC2 Enjoy -The XWiki development team

1 0

XWiki 1.0 RC2 is now staged for testing
by Vincent Massol 25 Apr '07

25 Apr '07

Hi everyone, I've staged the RC2 release on http://www.xwiki.org/10rc2/ It would be nice if some of you could quickly try it out (we'd like to release ASAP) and let us know if it's working as expected. Once we get a few confirmations we'll officially release it. You can check the release notes on http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXWiki10RC2 Thanks a lot -Vincent (on behalf of the XWiki dev team)

1 1

Re: Antw: XWiki: Testing for WIKI-1139
by Vincent Massol 25 Apr '07

25 Apr '07

Hi Gunter, On Apr 25, 2007, at 3:51 PM, Gunter Leeb wrote: > Hi Vincent, > > I have just tried it, but with the same or similar exception. I have > replaced the xwiki.jar and restartet. I would like to send you a log > file, also to confirm that it is really picking up all your changes. > Would you please send me a log4j.properties configured so you can see > all the aspects that you need. > > Also, maybe it is relevant, but the pages got migrated from an old > 0.9.940 (?) installation. Thanks for trying it. Let's try to debug this... I think we can follow 2 leads: 1) In your patched version of RC1, can you try creating a new page with accents and then delete/rename it? 2) I'd like to reproduce your problem. Could you give me more information about your setup (i18n setup, database and container) and possibly it would be nice if you could send me a XAR export of your wiki (not the whole thing, maybe only a few pages) so that I can try it here. Could you also let me know exactly the steps you're performing? Thanks -Vincent PS: I'm ccing the dev list so that others can join us in debuggin this. > > Regards, > > Gunter > >>>> Vincent Massol <vincent(a)massol.net> 25.04.2007 14:30 >>> > Hi Gunter, > > I'm doing the release of XWiki 1.0 RC2 this afternoon and your bug > was one that I wanted to check out before releasing RC2. I don't know > > if you've seen but I have commented on http://jira.xwiki.org/jira/ > browse/XWIKI-1139. > > Do you think you could give it a quick try with the new JAR I've > uploaded for you? > > Thanks a lot > > -Vincent Massol > XWiki release manager

1 0

XWiki: au sujet d'un ancien patch i18n...
by Vincent Massol 25 Apr '07

25 Apr '07

Hi Gilles (and everyone interested), I have modified today the XWiki.getDocumentName() method. I've seen that you had modified it in the past to add the call to fixDecodedURI (). I think it's no longer required but I'd like to have your opinion on that. Here's the modified version: public String getDocumentName(XWikiRequest request, XWikiContext context) { [...] else { // TODO: Introduce a XWikiURL class in charge of getting the information relevant // to XWiki from a request URL (action, space, document name, file, etc) // Important: We cannot use getPathInfo() as the container encodes it and different // containers encode it differently, depending on their internal behavior and how // they are configured. Thus to make this container- proof we use the // getRequestURI() which isn't modified by the container and is thus only // URL-encoded. // Note: Ideally we should modify the getDocumentNameFromPath method but in order // not to introduce any new bug right now we're reconstructing a path info that we // pass to it using the following algorithm: // path info = requestURI - (contextPath + servletPath) String path; if (!request.getRequestURI().startsWith( request.getContextPath() + request.getServletPath())) { log.warn("Request URI [" + request.getRequestURI() + "] should have matched " + "context path [" + request.getContextPath() + "] and servlet path [" + request.getServletPath() + "]"); // Even though this branch shouldn't get executed we never know what containers // will return and thus in order to be safe we fall back to the previous // behavior which was to use getPathInfo() for getting the path (with the // potential issue with i18n encoding as stated above). path = request.getPathInfo(); } else { path = request.getRequestURI().substring( request.getContextPath().length() + request.getServletPath().length()); } // TODO: I think it's safe to remove the fixDecodedURI now that we're not using // getPathInfo() and thus the container doesn't encode anything but I don't want // to break anything at this late stage (we're releasing 1.0 RC2). Remove it when // we start working on 1.1. docname = getDocumentNameFromPath(fixDecodedURI(request, path), context); } } return docname; } Thanks a lot -Vincent

1 0

REST approach : a remote control for xwiki
by Thomas Krämer 25 Apr '07

25 Apr '07

Hello Developers i am working on a REST remote control for xwiki, based on an idea from Sergiu Dumitriu. The idea is to leave xwiki authorisation where it is (it works fine, as far as i can see), and have synchronized user and group data, as well as space acces rights. The drawbacks of this approach have been pointed out by Sergiu: updates and deletions (group membership, group right per space etc.) everything but easy to maintain. Nevertheless, it appears to be doable, and until the decision is made, which SSO xwiki will use in 1.1 / 2.0, i will continue this way. Two questions regarding acces rights: 1: When i have 2 groups aTeam and bTeam, and two spaces aSpace and bSapce, and each space has access rights entry that disallow viewing aSpace for everyone but admins and aTeam members (same for bTeam/bSpace): Why do bTeam members still see the aSpace in the right hand panel? bTeam members do *not* have access to the aSpace base page, created when creating aSpace, but an unresolved velocity fragment appears after trying to acces bSpace pages as aTeam member, vice versa. Is it correct, that it says "Web Home" in the panel instead of the title the spaces' default pages? 2: When adding new members to a group there is a strange beahviour, sometimes: instead of group member names after adding a user to the group, there is "Web Home". Why this? And is this fixed in RC1: http://mail-archive.objectweb.org/xwiki-users/2006-02/msg00103.html or do i have to add a $xwiki.flushCache() in a page, that is called each time groups are updated? I hope you can help wiht that topic, as a proper space access depending on group membership is a crucial function if you intend to use a wiki with a high number of users. Yours Thomas Krämer

1 0

General goals for the 1.1 release
by Vincent Massol 24 Apr '07

24 Apr '07

Hi, As we're getting closer to the 1.0 release we need to start thinking about the 1.1 goals. Things I'd like to propose for 1.1: ------------------------------------------ Note 1: I proposed a few weeks ago that we should a main release every 3-4 months, with beta releases every 2-3 weeks. I didn't get much answer and I concluded that it was ok for most of you. So we need to consider that time frame in mind for deciding the overall goal of the 1.1 release. Let's not be too ambitious... Note 2: The points below are listed by order of importance to me 1) There are still 108 bugs in JIRA. As a consequence I think one main goal of 1.1 is going to be the consolidation of 1.0. 2) Focus on making the default wiki a wiki that is a good as the wikis out there. This includes improvements to the look & feel/skin and to its usability. I don't think we need more features, we just need each feature to be better implemented: more polished, more intuitive, more documented, nicer looking. 3) Start introducing XWiki 2.0 architecture elements in it. Even though XWiki 2.0 will probably be done in a separate branch I think we should start backporting stuff that'll be done in that branch to 1.1 when possible. 4) Switch to a Maven2 build WDYT and what would you want to see in the 1.1 release? Thanks -Vincent

3 3

Issue to investigate
by Vincent Massol 24 Apr '07

24 Apr '07

Hi, MadOtis on IRC told me that users he had created with a staged RC1 version cannot see the Main/WebHome page even though they have the correct rights set up. Only new users created with the new RC1 can. I haven't reviewed the last changes we did in the released RC1 but we need to verify if this is a problem with users created in past betas and if so add some instructions in the release notes for migrating old users so that they work. Sergiu, maybe you know what the issue is? Thanks -Vincent

4 5

Re: [xwiki-commits] r2957 - in xwiki/trunk/core/src/main/java/com/xpn/xwiki: objects/classes objects/meta plugin/packaging user/impl/xwiki
by Vincent Massol 24 Apr '07

24 Apr '07

Should any of these go in RC2 (I didn't see any merge and I'm asking to be sure we're not forgetting anything)? Same question for rev 2959 ("Forgot something...", which btw should have contained a jira reference... ;-)) Thanks -Vincent On Apr 23, 2007, at 10:23 PM, Sergiu Dumitriu wrote: > Author: sdumitriu > Date: 2007-04-23 22:23:53 +0200 (Mon, 23 Apr 2007) > New Revision: 2957 > > Modified: > xwiki/trunk/core/src/main/java/com/xpn/xwiki/objects/classes/ > PasswordClass.java > xwiki/trunk/core/src/main/java/com/xpn/xwiki/objects/meta/ > PasswordMetaClass.java > xwiki/trunk/core/src/main/java/com/xpn/xwiki/plugin/packaging/ > Package.java > xwiki/trunk/core/src/main/java/com/xpn/xwiki/user/impl/xwiki/ > XWikiAuthServiceImpl.java > Log: > XWIKI-70: password can be searched > XWIKI-580: Implement HASH password mechanism > > Added support for hashing passwords. There's some code related to > encrypting passwords, but the actual encrypt/decrypt mechanism is > not written yet. > > > > Modified: xwiki/trunk/core/src/main/java/com/xpn/xwiki/objects/ > classes/PasswordClass.java > =================================================================== > --- xwiki/trunk/core/src/main/java/com/xpn/xwiki/objects/classes/ > PasswordClass.java 2007-04-23 20:16:46 UTC (rev 2956) > +++ xwiki/trunk/core/src/main/java/com/xpn/xwiki/objects/classes/ > PasswordClass.java 2007-04-23 20:23:53 UTC (rev 2957) > @@ -1,70 +1,239 @@ > -/* > - * Copyright 2006, XpertNet SARL, and individual contributors as > indicated > - * by the contributors.txt. > - * > - * This is free software; you can redistribute it and/or modify it > - * under the terms of the GNU Lesser General Public License as > - * published by the Free Software Foundation; either version 2.1 of > - * the License, or (at your option) any later version. > - * > - * This software is distributed in the hope that it will be useful, > - * but WITHOUT ANY WARRANTY; without even the implied warranty of > - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > - * Lesser General Public License for more details. > - * > - * You should have received a copy of the GNU Lesser General Public > - * License along with this software; if not, write to the Free > - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA > - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. > - * > - * @author sdumitriu > - */ > - > -package com.xpn.xwiki.objects.classes; > - > -import com.xpn.xwiki.XWikiContext; > -import com.xpn.xwiki.objects.BaseCollection; > -import com.xpn.xwiki.objects.BaseProperty; > -import com.xpn.xwiki.objects.ElementInterface; > -import com.xpn.xwiki.objects.meta.PropertyMetaClass; > -import org.apache.ecs.xhtml.input; > - > -public class PasswordClass extends StringClass { > - public PasswordClass(PropertyMetaClass wclass) { > - super("password", "Password", wclass); > - setxWikiClass(wclass); > - } > - > - public PasswordClass() { > - this(null); > - } > - > - public BaseProperty fromString(String value) { > - if (value.equals("********")) > - return null; > - else > - return super.fromString(value); > - } > - > - public void displayHidden(StringBuffer buffer, String name, > String prefix, BaseCollection object, XWikiContext context) { > - // Passwords cannot go through the preview interface of we > don't do something here.. > - } > - > - public void displayView(StringBuffer buffer, String name, > String prefix, BaseCollection object, XWikiContext context) { > - ElementInterface prop = object.safeget(name); > - if (prop!=null) > - buffer.append("********"); > - } > - > - public void displayEdit(StringBuffer buffer, String name, > String prefix, BaseCollection object, XWikiContext context) { > - input input = new input(); > - ElementInterface prop = object.safeget(name); > - if (prop!=null) input.setValue("********"); > - > - input.setType("password"); > - input.setName(prefix + name); > - input.setID(prefix + name); > - input.setSize(getSize()); > - buffer.append(input.toString()); > - } > -} > \ No newline at end of file > +/* > + * Copyright 2006, XpertNet SARL, and individual contributors as > indicated > + * by the contributors.txt. > + * > + * This is free software; you can redistribute it and/or modify it > + * under the terms of the GNU Lesser General Public License as > + * published by the Free Software Foundation; either version 2.1 of > + * the License, or (at your option) any later version. > + * > + * This software is distributed in the hope that it will be useful, > + * but WITHOUT ANY WARRANTY; without even the implied warranty of > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > + * Lesser General Public License for more details. > + * > + * You should have received a copy of the GNU Lesser General Public > + * License along with this software; if not, write to the Free > + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA > + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. > + * > + * @author sdumitriu > + */ > + > +package com.xpn.xwiki.objects.classes; > + > +import java.security.MessageDigest; > +import java.security.NoSuchAlgorithmException; > + > +import org.apache.commons.logging.Log; > +import org.apache.commons.logging.LogFactory; > +import org.apache.ecs.xhtml.input; > + > +import com.xpn.xwiki.XWikiContext; > +import com.xpn.xwiki.objects.BaseCollection; > +import com.xpn.xwiki.objects.BaseProperty; > +import com.xpn.xwiki.objects.ElementInterface; > +import com.xpn.xwiki.objects.meta.PasswordMetaClass; > +import com.xpn.xwiki.objects.meta.PropertyMetaClass; > + > +public class PasswordClass extends StringClass > +{ > + protected static Log log = LogFactory.getFactory().getInstance > (PasswordClass.class); > + > + protected static final String DEFAULT_STORAGE = > PasswordMetaClass.HASH; > + > + protected static final String DEFAULT_HASH_ALGORITHM = "SHA-512"; > + > + protected static final String DEFAULT_CRYPT_ALGORITHM = "AES"; > + > + protected static final String HASH_IDENTIFIER = "hash"; > + > + protected static final String CRYPT_IDENTIFIER = "crypt"; > + > + protected static final String SEPARATOR = ":"; > + > + protected static final String FORM_PASSWORD_PLACEHODLER = > "********"; > + > + public PasswordClass(PropertyMetaClass wclass) > + { > + super("password", "Password", wclass); > + setxWikiClass(wclass); > + } > + > + public PasswordClass() > + { > + this(null); > + } > + > + public BaseProperty fromString(String value) > + { > + if (value.equals(FORM_PASSWORD_PLACEHODLER)) { > + return null; > + } > + BaseProperty property = newProperty(); > + property.setValue(getProcessedPassword(value)); > + return property; > + } > + > + public void displayHidden(StringBuffer buffer, String name, > String prefix, > + BaseCollection object, XWikiContext context) > + { > + // Passwords cannot go through the preview interface, so > we don't do something here.. > + } > + > + public void displayView(StringBuffer buffer, String name, > String prefix, > + BaseCollection object, XWikiContext context) > + { > + ElementInterface prop = object.safeget(name); > + if (prop != null) { > + buffer.append(FORM_PASSWORD_PLACEHODLER); > + } > + } > + > + public void displayEdit(StringBuffer buffer, String name, > String prefix, > + BaseCollection object, XWikiContext context) > + { > + input input = new input(); > + ElementInterface prop = object.safeget(name); > + if (prop != null) { > + input.setValue(FORM_PASSWORD_PLACEHODLER); > + } > + > + input.setType("password"); > + input.setName(prefix + name); > + input.setSize(getSize()); > + buffer.append(input.toString()); > + } > + > + /** > + * > + * @return One of 'Clear', 'Hash' or 'Encrypt'. > + */ > + public String getStorageType() > + { > + BaseProperty st = (BaseProperty) this.getField > ("storageType"); > + if (st != null) { > + String type = st.getValue().toString().trim(); > + if (!type.equals("")) { > + return type; > + } > + } > + return DEFAULT_STORAGE; > + } > + > + /** > + * > + * @return The hash algorithm configured for this XProperty. > + */ > + public String getHashAlgorithm() > + { > + BaseProperty alg = (BaseProperty) this.getField > (PasswordMetaClass.ALGORITHM_KEY); > + if (alg != null && alg.getValue() != null && !alg.getValue > ().toString().trim().equals("")) { > + return alg.getValue().toString(); > + } > + return DEFAULT_HASH_ALGORITHM; > + } > + > + /** > + * > + * @return The encryption algorithm configured for this > XProperty. > + */ > + public String getCryptAlgorithm() > + { > + BaseProperty alg = (BaseProperty) this.getField > (PasswordMetaClass.ALGORITHM_KEY); > + if (alg != null && alg.getValue() != null && !alg.getValue > ().toString().trim().equals("")) { > + return alg.getValue().toString(); > + } > + return DEFAULT_CRYPT_ALGORITHM; > + } > + > + /** > + * > + * @param password > + * @return The algorithm used for the given password. > + */ > + public String getAlgorithmFromPassword(String password) > + { > + int beginIndex = password.indexOf(SEPARATOR) + 1; > + if (beginIndex >= 0) { > + int endIndex = password.indexOf(SEPARATOR, beginIndex); > + if (endIndex >= 0) { > + return password.substring(beginIndex, endIndex); > + } > + } > + return DEFAULT_HASH_ALGORITHM; > + } > + > + /** > + * Transforms a plain text password so that it has the same > encryption as a password stored in > + * the database. The current configuration for this password > XProperty cannot be used, as the > + * user might have a different encryption mechanism (for > example, if the user was imported, or > + * the password was not yet upgraded). > + * > + * @param storedPassword The stored password, which gives the > storage type and algorithm. > + * @param plainPassword The plain text password to be encrypted. > + * @return The input password, encrypted with the same > mechanism as the stored password. > + */ > + public String getEquivalentPassword(String storedPassword, > String plainPassword) > + { > + String result = plainPassword; > + if (storedPassword.startsWith(HASH_IDENTIFIER + SEPARATOR)) { > + result = getPasswordHash(result, > getAlgorithmFromPassword(storedPassword)); > + } else if (storedPassword.startsWith(CRYPT_IDENTIFIER + > SEPARATOR)) { > + result = getPasswordCrypt(result, > getAlgorithmFromPassword(storedPassword)); > + } > + return result; > + } > + > + public String getProcessedPassword(String password) > + { > + String storageType = getStorageType(); > + String result = password; > + if (storageType.equals(PasswordMetaClass.HASH)) { > + result = getPasswordHash(result); > + } else if (storageType.equals(PasswordMetaClass.ENCRYPTED)) { > + result = getPasswordCrypt(result); > + } > + return result; > + } > + > + public String getPasswordCrypt(String password) > + { > + return getPasswordCrypt(password, getCryptAlgorithm()); > + } > + > + public String getPasswordCrypt(String password, String > algorithmName) > + { > + // TODO Write me! > + return password; > + } > + > + public String getPasswordHash(String password) > + { > + return getPasswordHash(password, getHashAlgorithm()); > + } > + > + public String getPasswordHash(String password, String > algorithmName) > + { > + try { > + MessageDigest hashAlgorithm = MessageDigest.getInstance > (algorithmName); > + hashAlgorithm.update(password.getBytes()); > + byte[] digest = hashAlgorithm.digest(); > + StringBuffer sb = > + new StringBuffer(HASH_IDENTIFIER + SEPARATOR + > algorithmName + SEPARATOR); > + for (int j = 0; j < digest.length; ++j) { > + int b = digest[j] & 0xFF; > + if (b < 0x10) > + sb.append('0'); > + sb.append(Integer.toHexString(b)); > + } > + return sb.toString(); > + } catch (NoSuchAlgorithmException ex) { > + log.error("Wrong hash algorithm '" + algorithmName + > "' in '" + this.className + "'", > + ex); > + } catch (NullPointerException ex) { > + log.error("Error hashing password", ex); > + } > + return password; > + } > +} > > Modified: xwiki/trunk/core/src/main/java/com/xpn/xwiki/objects/meta/ > PasswordMetaClass.java > =================================================================== > --- xwiki/trunk/core/src/main/java/com/xpn/xwiki/objects/meta/ > PasswordMetaClass.java 2007-04-23 20:16:46 UTC (rev 2956) > +++ xwiki/trunk/core/src/main/java/com/xpn/xwiki/objects/meta/ > PasswordMetaClass.java 2007-04-23 20:23:53 UTC (rev 2957) > @@ -1,5 +1,5 @@ > /* > - * Copyright 2006, XpertNet SARL, and individual contributors as > indicated > + * Copyright 2006-2007, XpertNet SARL, and individual contributors > as indicated > * by the contributors.txt. > * > * This is free software; you can redistribute it and/or modify it > @@ -17,7 +17,6 @@ > * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA > * 02110-1301 USA, or see the FSF site: http://www.fsf.org. > * > - * @author ludovic > */ > > package com.xpn.xwiki.objects.meta; > @@ -25,17 +24,46 @@ > import com.xpn.xwiki.XWikiContext; > import com.xpn.xwiki.objects.BaseCollection; > import com.xpn.xwiki.objects.classes.PasswordClass; > +import com.xpn.xwiki.objects.classes.StaticListClass; > +import com.xpn.xwiki.objects.classes.StringClass; > > -public class PasswordMetaClass extends StringMetaClass { > +public class PasswordMetaClass extends StringMetaClass > +{ > + public static final String CLEAR = "Clear"; > > - public PasswordMetaClass() { > + public static final String ENCRYPTED = "Encrypted"; > + > + public static final String HASH = "Hash"; > + > + public static final String SEPARATOR = "|"; > + > + public static final String ALGORITHM_KEY = "algorithm"; > + > + public PasswordMetaClass() > + { > super(); > - // setType("passwordmetaclass"); > setPrettyName("Password Class"); > setName(PasswordClass.class.getName()); > + > + StaticListClass storageType_class = new StaticListClass > (this); > + storageType_class.setName("storageType"); > + storageType_class.setPrettyName("Storage type"); > + storageType_class.setValues(CLEAR + SEPARATOR + HASH);// + > SEPARATOR + ENCRYPTED > + storageType_class.setRelationalStorage(false); > + storageType_class.setDisplayType("select"); > + storageType_class.setMultiSelect(false); > + storageType_class.setSize(1); > + safeput("storageType", storageType_class); > + > + StringClass encryptAlgorithm_class = new StringClass(this); > + encryptAlgorithm_class.setName(ALGORITHM_KEY); > + encryptAlgorithm_class.setPrettyName("Encryption/hash > algorithm"); > + encryptAlgorithm_class.setSize(20); > + safeput("encryptAlgorithm", encryptAlgorithm_class); > } > > - public BaseCollection newObject(XWikiContext context) { > + public BaseCollection newObject(XWikiContext context) > + { > return new PasswordClass(); > } > } > > Modified: xwiki/trunk/core/src/main/java/com/xpn/xwiki/plugin/ > packaging/Package.java > =================================================================== > --- xwiki/trunk/core/src/main/java/com/xpn/xwiki/plugin/packaging/ > Package.java 2007-04-23 20:16:46 UTC (rev 2956) > +++ xwiki/trunk/core/src/main/java/com/xpn/xwiki/plugin/packaging/ > Package.java 2007-04-23 20:23:53 UTC (rev 2957) > @@ -755,6 +755,12 @@ > ZipEntry zipentry = new ZipEntry(zipname); > zos.putNextEntry(zipentry); > String docXml = doc.toXML(true, false, true, > withVersions, context); > + if (!context.getWiki().getRightService().hasAdminRights > (context)) { > + docXml = > + context.getUtil().substitute( > + "s/<password>.*?<\\/password>/ > <password>********<\\/password>/goi", > + docXml); > + } > zos.write(docXml.getBytes(context.getWiki().getEncoding > ())); > zos.closeEntry(); > } catch (Exception e) { > @@ -786,6 +792,12 @@ > } > File file = new File(spacedir, filename); > String xml = doc.toXML(true, false, true, > withVersions, context); > + if (!context.getWiki().getRightService().hasAdminRights > (context)) { > + xml = > + context.getUtil().substitute( > + "s/<password>.*?<\\/password>/ > <password>********<\\/password>/goi", > + xml); > + } > FileOutputStream fos = new FileOutputStream(file); > fos.write(xml.getBytes(context.getWiki().getEncoding())); > fos.flush(); > > Modified: xwiki/trunk/core/src/main/java/com/xpn/xwiki/user/impl/ > xwiki/XWikiAuthServiceImpl.java > =================================================================== > --- xwiki/trunk/core/src/main/java/com/xpn/xwiki/user/impl/xwiki/ > XWikiAuthServiceImpl.java 2007-04-23 20:16:46 UTC (rev 2956) > +++ xwiki/trunk/core/src/main/java/com/xpn/xwiki/user/impl/xwiki/ > XWikiAuthServiceImpl.java 2007-04-23 20:23:53 UTC (rev 2957) > @@ -22,27 +22,30 @@ > > package com.xpn.xwiki.user.impl.xwiki; > > +import java.io.IOException; > +import java.security.Principal; > +import java.util.List; > + > +import javax.servlet.http.HttpServletRequest; > +import javax.servlet.http.HttpServletResponse; > + > +import org.apache.commons.lang.StringUtils; > +import org.apache.commons.logging.Log; > +import org.apache.commons.logging.LogFactory; > +import org.securityfilter.config.SecurityConfig; > +import org.securityfilter.filter.SecurityRequestWrapper; > +import org.securityfilter.realm.SimplePrincipal; > + > import com.xpn.xwiki.XWiki; > import com.xpn.xwiki.XWikiContext; > import com.xpn.xwiki.XWikiException; > +import com.xpn.xwiki.doc.XWikiDocument; > +import com.xpn.xwiki.objects.classes.PasswordClass; > import com.xpn.xwiki.plugin.ldap.LDAPPlugin; > -import com.xpn.xwiki.doc.XWikiDocument; > import com.xpn.xwiki.user.api.XWikiAuthService; > import com.xpn.xwiki.user.api.XWikiUser; > import com.xpn.xwiki.web.Utils; > -import org.apache.commons.lang.StringUtils; > -import org.apache.commons.logging.Log; > -import org.apache.commons.logging.LogFactory; > -import org.securityfilter.config.SecurityConfig; > -import org.securityfilter.filter.SecurityRequestWrapper; > -import org.securityfilter.realm.SimplePrincipal; > > -import javax.servlet.http.HttpServletRequest; > -import javax.servlet.http.HttpServletResponse; > -import java.io.IOException; > -import java.security.Principal; > -import java.util.List; > - > public class XWikiAuthServiceImpl implements XWikiAuthService > { > private static final Log log = LogFactory.getLog > (XWikiAuthServiceImpl.class); > @@ -390,6 +393,10 @@ > // We only allow empty password from users having a > XWikiUsers object. > if (doc.getObject("XWiki.XWikiUsers") != null) { > String passwd = doc.getStringValue > ("XWiki.XWikiUsers", "password"); > + password = > + ((PasswordClass) context.getWiki().getClass > ("XWiki.XWikiUsers", context) > + .getField > ("password")).getEquivalentPassword(passwd, password); > + > result = (password.equals(passwd)); > } > > > > > -- > You receive this message as a subscriber of the xwiki- > commits(a)objectweb.org mailing list. > To unsubscribe: mailto:[email protected] > For general help: mailto:[email protected]?subject=help > ObjectWeb mailing lists service home page: http://www.objectweb.org/ > wws

2 2

[JIRA] Tracability from commits
by Vincent Massol 24 Apr '07

24 Apr '07

Hi committers, I see that we're now quite good at putting jira references in our first commits. That's good! However sometimes when we make a mistake, or forget something to commit, we don't put again the reference to the JIRA issue in the subsequent commits. It would be better if we were always putting the reference to JIRA. For example, I fixed something related to XWIKI-49 this morning and I used the following format: " XWIKI-49: PDF generation failed with vietnamese characters encoded in UTF-8 * Replaced SNAPSHOT by a timestamped version so that the build can be reproduced and so that we can perform a release of RC2 tomorrow. * Moved out the JTidy <dependency> as it was now wrongly in the "custom xwiki repository" section. * Removed JTidy from our custom XWiki repository " Why do we need this? Because it then makes it very easy later on to find what happened related to a JIRA issue. We had this need for example when we were trying to find out the difference between 2 branches (you may remember, I spent a whole day on that a month ago). Thanks to the Subversion plugin in JIRA we can see what happens related to an issue. For example: http://jira.xwiki.org/jira/browse/XWIKI-49? page=com.atlassian.jira.plugin.ext.subversion:subversion-commits- tabpanel However that only works if we have put a reference to the jira issue in the commit log. Thanks -Vincent

1 0