arturobernalg opened a new pull request, #550: URL: https://github.com/apache/jspwiki/pull/550
A user profile can be locked until a date (UserProfile.setLockExpiry), but nothing made use of it. Locking accounts automatically, as JSPWIKI-1254 asks for, needs the lock to work first. This fixes three problems that I reproduced with tests before changing the code. UserDatabaseLoginModule never looked at the lock, so a locked profile could log in. It now refuses a locked profile that supplies the right password, with an AccountLockedException. With a wrong password the failure is the usual one, so the lock is not disclosed to someone who does not know the password. The login is not otherwise changed. XMLUserDatabase wrote the lock expiry in its date format but read it back with Long.parseLong, so saving a lock made that profile unreadable, with a NumberFormatException on every login attempt. It now reads the date format, still accepts the milliseconds that the old code expected, and keeps the profile locked if the value cannot be read, as the file may have been tampered with and opening the account would be the unsafe way to fail. JDBCUserDatabase stored the lock expiry as a date without the time, so a lock of one hour ended at midnight of the day it was set and the profile was not locked when it was read back. It now stores a timestamp. The lock_expiry column of the sample schemas is already a timestamp. I did not add a Jira issue for these; JSPWIKI-1254 is the closest one, and it is assigned to Alex O'Ree, so this should be agreed with them. The rest of JSPWIKI-1254 (password age, reminders, forced change, deletion) is not part of this change. Tests: 4 new cases in UserDatabaseLoginModuleTest (locked profile cannot log in, wrong password gives the ordinary failure, an expired lock can log in, other profiles are not affected), 4 in XMLUserDatabaseTest (the lock is saved and read, cleared, read from milliseconds, kept when unreadable) and 1 in JDBCUserDatabaseTest. The login tests and the JDBC test failed before the change. The jspwiki-util, jspwiki-event and jspwiki-main suites pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
