You are viewing a plain text version of this content. The canonical link for it is here.

Posted to oak-issues@jackrabbit.apache.org by "Angela Schreiber (Jira)" <ji...@apache.org> on 2020/09/30 09:20:00 UTC

[jira] [Resolved] (OAK-9245) UserValidator.propertyChanged may miss plaintext password

     [ https://issues.apache.org/jira/browse/OAK-9245?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Angela Schreiber resolved OAK-9245.
-----------------------------------
    Fix Version/s: 1.36.0
       Resolution: Fixed

Committed revision 1882154.


> UserValidator.propertyChanged may miss plaintext password
> ---------------------------------------------------------
>
>                 Key: OAK-9245
>                 URL: https://issues.apache.org/jira/browse/OAK-9245
>             Project: Jackrabbit Oak
>          Issue Type: Bug
>          Components: core, security
>            Reporter: Angela Schreiber
>            Assignee: Angela Schreiber
>            Priority: Major
>             Fix For: 1.36.0
>
>
> {{UserValidator.propertyChanged}} only verifies if the password property has not been changed to plain-text if the nodestate _before_ the modification was a user node. inserting a user by modifying the primary type of an non-user node, would result in the pw constraint not being properly validated.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)