You are viewing a plain text version of this content. The canonical link for it is here.

Posted to oak-issues@jackrabbit.apache.org by "angela (JIRA)" <ji...@apache.org> on 2019/06/18 08:40:00 UTC

[jira] [Created] (OAK-8408) UserImporter must not trigger creation of rep:pwd node unless included in xml

angela created OAK-8408:
---------------------------

             Summary: UserImporter must not trigger creation of rep:pwd node unless included in xml
                 Key: OAK-8408
                 URL: https://issues.apache.org/jira/browse/OAK-8408
             Project: Jackrabbit Oak
          Issue Type: Bug
          Components: core, security
            Reporter: angela
            Assignee: angela


when xml-importing an existing user (i.e. {{Tree}} doesn't have status NEW upon import) calling {{UserManagerImpl.setPassword}} will force the creation of the {{rep:pwd}} node and {{rep:passwordLastModified}} property contained therein _if_ theinitial-password-change feature is enabled.

imo the {{rep:pwd}} (and any properties contained therein) must not be auto-created by should only be imported if contained in the XML. 

proposed fix: {{UserManagerImpl.setPassword}} already contains special treatment for the password hashing triggered upon xml import -> renaming that flag and respect it for the handling of the pw last modified.

[~stillalex], wdyt?



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)