Ok. +1
I think it is acceptable way.
rssh wrote:
Why we need to
force setDatabase in non virtual mode?
Because we want set name of database. It is what this patch must do.
I'm afraid this answer is not ideall for you. May be next sentence help: it
is impossible to set database in hibernate in other way, than do all
functionality, which is in 'setDatabase()'
[Alternative is rewrite configuration part of hibernate]
Is it only for fix security issues?
Let's imagine that we does not call setDatabase
in this case setting database will be possible via next procedure:
-- change name in hibernate config
-- set same name to xwiki.db (to call updateSchema with correct database)
(and yes, it can be insecure)
With call of setDatabase we
a) does not require from user to change hibernate config.
b) prevent call of setDatabase from user code. (security)
Note, that only change name in hibernate config is incorrect and in general
will not work, because updateScheme in some cases will generate full name of
tables (with schema part) which we can't deduce and can't get from hibernate.