[
https://issues.apache.org/jira/browse/JSPWIKI-1233?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18133438#comment-18133438
]
Arturo Bernal commented on JSPWIKI-1233:
----------------------------------------
Checked against current master. New passwords are hashed with PBKDF2:
AbstractUserDatabase.getHash calls CryptoUtil.getPbkdf2SaltedPassword. Old
unsalted SHA values are only read, never written: validatePassword accepts them
and, after a successful login, saves the password again in the PBKDF2 format. I
ran this against the JDBC user database test fixture. The user janne starts
with an unsalted SHA value; after one valid login the stored value starts with
the PBKDF2 prefix, the same password still validates and a wrong password does
not. A newly saved profile is stored with the PBKDF2 prefix as well. The only
SHA code left is getShaHash, marked as deprecated and kept to verify and
upgrade old entries, and JDBCUserDatabaseTest keeps old SHA values on purpose
as fixtures for that path. The existing user database tests pass. I did not
find the commit that fixed this, and the ticket does not say which API it
meant, so I leave it open for the reporter to confirm.
> AbstractUserDatabase uses deprecated SHA based password hashing, when updated
> to correct API, unit test fail
> ------------------------------------------------------------------------------------------------------------
>
> Key: JSPWIKI-1233
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1233
> Project: JSPWiki
> Issue Type: Bug
> Reporter: Alex O'Ree
> Priority: Minor
>
> it's related to JDBCUserDatabaseTest. definitely should fix this
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
