arturobernalg opened a new pull request, #551: URL: https://github.com/apache/jspwiki/pull/551
This builds on #549 (JSPWIKI-1231) and #550 (the lock of a profile, JSPWIKI-1254), and the branch holds their commits. Only the last commit, "JSPWIKI-1254 Let passwords expire", is new here; this will shrink once those two are merged. JSPWIKI-1254 is assigned to Alex O'Ree, so this should be agreed with them; it is a first part of that issue. The property jspwiki.credentials.expiry.days sets a number of days after which the password of a user of the wiki's user database has to be changed. It is off by default (0). A value that is not a number, or is negative, is logged and passwords do not expire. The date a password was last changed is now part of the user profile (UserProfile.getPasswordChanged, since 3.0.1, a default method so other implementations still compile). The user databases set it when a profile is saved with a password that is not the stored one. Hashing the same password again, which happens at login when the algorithm or the iterations changed (#549), is not a change of password and does not start the clock again. The XML user database keeps the date in a new attribute. The JDBC user database needs a column, named by jspwiki.userdatabase.passwordChanged, which is optional so existing deployments keep working. The sample schemas have it (password_changed), and a warning is logged if expiry is enabled without the column. At login, a user who gives the right password but whose password has expired is not logged in and is told so, with a message in the session that Login.jsp shows instead of the generic one. Someone who does not know the password is not told. The lost password feature of the login page, or an administrator, sets a new password, which starts the clock again. A profile that has no date yet gets it at its next login, so that enabling the feature does not lock everybody out at once. The check only applies when users authenticate with the wiki's user database, not with a container or another login module. Not part of this change: reminders by e-mail before the password expires, a page to change the password in the same login (the user has to reset it), locking and deleting accounts after more days, the e-mail after a long time without logging in, and an administration page for these. The new message is in English in the bundles of the other languages until someone translates it. Tests: 15 in PasswordExpiryTest (the limit and its boundaries, invalid values, login of a user that has not expired, the expired one with its message, no message for a wrong password, the new password allowing the login again, a profile without a date getting it at login, nothing happening when it is off), 7 for the date in XMLUserDatabaseTest and 7 in JDBCUserDatabaseTest. The login tests failed before the change. The jspwiki-util, jspwiki-event and jspwiki-main suites pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
