Ok. +1 I think it is acceptable way. rssh wrote: >> Why we need to force setDatabase in non virtual mode? > > Because we want set name of database. It is what this patch must do. > > I'm afraid this answer is not ideall for you. May be next sentence help: it > is impossible to set database in hibernate in other way, than do all > functionality, which is in 'setDatabase()' > > [Alternative is rewrite configuration part of hibernate] > >> Is it only for fix security issues? > > Let's imagine that we does not call setDatabase > in this case setting database will be possible via next procedure: > -- change name in hibernate config > -- set same name to xwiki.db (to call updateSchema with correct database) > > (and yes, it can be insecure) > > With call of setDatabase we > a) does not require from user to change hibernate config. > b) prevent call of setDatabase from user code. (security) > > > Note, that only change name in hibernate config is incorrect and in general > will not work, because updateScheme in some cases will generate full name of > tables (with schema part) which we can't deduce and can't get from hibernate.
-- Artem Melentyev _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
