The following comment has been added to this issue:
Author: Arthur D'Alessandro
Created: Tue, 7 Sep 2004 1:46 PM
Body:
I have been able to resolve the issue by modifying the UserUpdateAction, and the
TurbineUserManagement classes.
Patches to 1.5 src posted below, please review, and comment:
Index: TurbineUserManagement.java
===================================================================
RCS file:
/cvsroot/Jetspeed-1.5/src/java/org/apache/jetspeed/services/security/turbine/TurbineUserManagement.java,v
retrieving revision 1.1
diff -u -r1.1 TurbineUserManagement.java
--- TurbineUserManagement.java 31 Aug 2004 20:00:59 -0000 1.1
+++ TurbineUserManagement.java 7 Sep 2004 20:34:19 -0000
@@ -15,7 +15,6 @@
*/
package org.apache.jetspeed.services.security.turbine;
-
import java.util.List;
import java.util.Iterator;
import java.util.Date;
@@ -240,6 +239,7 @@
"', User doesn't exist");
}
Criteria criteria = TurbineUserPeer.buildCriteria(user);
+
try
{
TurbineUserPeer.doUpdate(criteria);
@@ -452,7 +452,14 @@
throw new UnknownUserException("The account '" +
user.getUserName() + "' does not exist");
}
- user.setPassword(JetspeedSecurity.encryptPassword(password));
+
+ // Compare the old and new, if they are equal, store as is, otherwise go
through encryptPassword
+ if (user.getPassword().equalsIgnoreCase(password)) {
+ user.setPassword(password);
+ } else {
+ user.setPassword(this.encryptPassword(password));
+ }
+
// save the changes in the database immediately, to prevent the
// password being 'reverted' to the old value if the user data
// is lost somehow before it is saved at session's expiry.
Index: UserUpdateAction.java
===================================================================
RCS file:
/cvsroot/Jetspeed-1.5/src/java/org/apache/jetspeed/modules/actions/portlets/security/UserUpdateAction.java,v
retrieving revision 1.1
diff -u -r1.1 UserUpdateAction.java
--- UserUpdateAction.java 31 Aug 2004 20:00:54 -0000 1.1
+++ UserUpdateAction.java 7 Sep 2004 20:44:26 -0000
@@ -392,6 +392,10 @@
throws Exception
{
JetspeedUser user = null;
+
+ // Keep track of the original password before we apply the request parameters
+ String strOriginalPassword= "";
+
try
{
//
@@ -399,78 +403,84 @@
//
user = (JetspeedUser)JetspeedSecurity.getUser(
rundata.getParameters().getString(SecurityConstants.PARAM_ENTITY_ID));
-
- String name = rundata.getParameters().getString("username");
+
+ // Store this for comparison later
+ strOriginalPassword= user.getPassword();
+
+ String name = rundata.getParameters().getString("username");
if (name == null || name.trim().length() == 0)
{
- DynamicURI duri = new DynamicURI (rundata);
- duri.addPathInfo(SecurityConstants.PANE_NAME,
SecurityConstants.PANEID_USER_UPDATE);
- duri.addPathInfo(SecurityConstants.PARAM_MSGID,
SecurityConstants.MID_INVALID_ENTITY_NAME);
- if (user != null)
- duri.addPathInfo(SecurityConstants.PARAM_ENTITY_ID,
user.getUserName());
- duri.addQueryData(SecurityConstants.PARAM_MODE,
SecurityConstants.PARAM_MODE_UPDATE);
- rundata.setRedirectURI(duri.toString());
- // save values that user just entered so they don't have to re-enter
- if (user != null)
- rundata.getUser().setTemp(TEMP_USER, user);
- return;
- }
-
- //
- // pull the values off the form and into the user object
- //
- boolean oldDisabled = user.getDisabled();
- rundata.getParameters().setProperties(user);
- user.setLastAccessDate();
-
-
JetspeedSecurity.forcePassword(user,rundata.getParameters().getString("password"));
-
- String strDisabled = rundata.getParameters().getString("disabled");
- boolean disabled = (strDisabled != null);
- user.setDisabled(disabled);
-
- if (!disabled && oldDisabled &&
JetspeedSecurity.isDisableAccountCheckEnabled())
- {
- JetspeedSecurity.resetDisableAccountCheck(name);
- }
-
- //
- // update the user in the database
- //
- JetspeedSecurity.saveUser(user);
-
- JetspeedUser currentUser = (JetspeedUser)rundata.getUser();
- if (currentUser.getUserName().equals(user.getUserName()))
- {
- // same user as admin -- need to update in memory
- currentUser.setPassword(user.getPassword()); // Contains Encrypted
password
- currentUser.setFirstName(user.getFirstName());
- currentUser.setLastName(user.getLastName());
- currentUser.setEmail(user.getEmail());
- }
-
+ DynamicURI duri = new DynamicURI (rundata);
+ duri.addPathInfo(SecurityConstants.PANE_NAME,
SecurityConstants.PANEID_USER_UPDATE);
+ duri.addPathInfo(SecurityConstants.PARAM_MSGID,
SecurityConstants.MID_INVALID_ENTITY_NAME);
+ if (user != null)
+ duri.addPathInfo(SecurityConstants.PARAM_ENTITY_ID,
user.getUserName());
+ duri.addQueryData(SecurityConstants.PARAM_MODE,
SecurityConstants.PARAM_MODE_UPDATE);
+ rundata.setRedirectURI(duri.toString());
+ // save values that user just entered so they don't have to
re-enter
+ if (user != null)
+ rundata.getUser().setTemp(TEMP_USER, user);
+ return;
+ }
+
+ //
+ // pull the values off the form and into the user object
+ //
+ boolean oldDisabled = user.getDisabled();
+ rundata.getParameters().setProperties(user);
+ user.setLastAccessDate();
+
+ // Set user object password back to original password before request
parameters were applied
+ user.setPassword(strOriginalPassword);
+
+
JetspeedSecurity.forcePassword(user,rundata.getParameters().getString("password"));
+
+ String strDisabled = rundata.getParameters().getString("disabled");
+ boolean disabled = (strDisabled != null);
+ user.setDisabled(disabled);
+
+ if (!disabled && oldDisabled &&
JetspeedSecurity.isDisableAccountCheckEnabled())
+ {
+ JetspeedSecurity.resetDisableAccountCheck(name);
+ }
+
+ //
+ // update the user in the database
+ //
+ JetspeedSecurity.saveUser(user);
+
+ JetspeedUser currentUser = (JetspeedUser)rundata.getUser();
+ if (currentUser.getUserName().equals(user.getUserName()))
+ {
+ // same user as admin -- need to update in memory
+ currentUser.setPassword(user.getPassword()); // Contains Encrypted
password
+ currentUser.setFirstName(user.getFirstName());
+ currentUser.setLastName(user.getLastName());
+ currentUser.setEmail(user.getEmail());
+ }
+
}
catch (Exception e)
{
- // log the error msg
- logger.error("Exception", e);
-
- //
- // error on update - display error message
- //
- DynamicURI duri = new DynamicURI (rundata);
- duri.addPathInfo(SecurityConstants.PANE_NAME,
SecurityConstants.PANEID_USER_UPDATE);
- duri.addPathInfo(SecurityConstants.PARAM_MSGID,
SecurityConstants.MID_UPDATE_FAILED);
- if (user != null)
- duri.addPathInfo(SecurityConstants.PARAM_ENTITY_ID,
user.getUserName());
- duri.addQueryData(SecurityConstants.PARAM_MODE,
SecurityConstants.PARAM_MODE_UPDATE);
- rundata.setRedirectURI(duri.toString());
- // save values that user just entered so they don't have to re-enter
- if (user != null)
- rundata.getUser().setTemp(TEMP_USER, user);
- }
+ // log the error msg
+ logger.error("Exception", e);
+
+ //
+ // error on update - display error message
+ //
+ DynamicURI duri = new DynamicURI (rundata);
+ duri.addPathInfo(SecurityConstants.PANE_NAME,
SecurityConstants.PANEID_USER_UPDATE);
+ duri.addPathInfo(SecurityConstants.PARAM_MSGID,
SecurityConstants.MID_UPDATE_FAILED);
+ if (user != null)
+ duri.addPathInfo(SecurityConstants.PARAM_ENTITY_ID, user.getUserName());
+ duri.addQueryData(SecurityConstants.PARAM_MODE,
SecurityConstants.PARAM_MODE_UPDATE);
+ rundata.setRedirectURI(duri.toString());
+ // save values that user just entered so they don't have to re-enter
+ if (user != null)
+ rundata.getUser().setTemp(TEMP_USER, user);
+ }
- }
+ }
/**
* Database Delete Action for Users. Performs deletes into security database.
---------------------------------------------------------------------
View this comment:
http://issues.apache.org/jira/browse/JS1-516?page=comments#action_52937
---------------------------------------------------------------------
View the issue:
http://issues.apache.org/jira/browse/JS1-516
Here is an overview of the issue:
---------------------------------------------------------------------
Key: JS1-516
Summary: UserUpdateAction re-encrypts encrypted password when secure.passwords=true
Type: Bug
Status: Unassigned
Priority: Major
Project: Jetspeed
Components:
Security
Versions:
1.5
Assignee:
Reporter: Arthur D'Alessandro
Created: Fri, 3 Sep 2004 2:14 PM
Updated: Tue, 7 Sep 2004 1:46 PM
Environment: Database: Postgres
JVM: J2DSK 1.4.02_04
OS: Redhat 9.x/Windows XPSP2
Description:
UserUpdateAction re-encrypts encrypted password when secure.passwords=true
Thus making the edit user capability unusable unless the purpose was to also reset the
password.
I've been throwing around something simple, such as:
services.JetspeedSecurity.secure.passwords.allowblank=true|false
UserUpdateAction.doUpdate: Null password is ok, depending on
if secure.passwords=true {
if (password != null) {
forcePassword(user,password)
} else {
if secure.passwords.allowblank {
if (unsetpassword) {
forcePassword(user,"")
}
} else {
// Skip, no changes
}
}
}
Modify user-form.vm, add a checkbox next to password (if
secure.passwords.allowblank=true) eg, Unset Password
---------------------------------------------------------------------
JIRA INFORMATION:
This message is automatically generated by JIRA.
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
