The following comment has been added to this issue:
Author: Arthur D'Alessandro
Created: Fri, 1 Oct 2004 9:15 AM
Body:
Has anyone else applied the posted patch. Will this patch make it into JS1.6?
---------------------------------------------------------------------
View this comment:
http://issues.apache.org/jira/browse/JS1-516?page=comments#action_53591
---------------------------------------------------------------------
View the issue:
http://issues.apache.org/jira/browse/JS1-516
Here is an overview of the issue:
---------------------------------------------------------------------
Key: JS1-516
Summary: UserUpdateAction re-encrypts encrypted password when secure.passwords=true
Type: Bug
Status: Unassigned
Priority: Major
Project: Jetspeed
Components:
Security
Versions:
1.5
Assignee:
Reporter: Arthur D'Alessandro
Created: Fri, 3 Sep 2004 2:14 PM
Updated: Fri, 1 Oct 2004 9:15 AM
Environment: Database: Postgres
JVM: J2DSK 1.4.02_04
OS: Redhat 9.x/Windows XPSP2
Description:
UserUpdateAction re-encrypts encrypted password when secure.passwords=true
Thus making the edit user capability unusable unless the purpose was to also reset the
password.
I've been throwing around something simple, such as:
services.JetspeedSecurity.secure.passwords.allowblank=true|false
UserUpdateAction.doUpdate: Null password is ok, depending on
if secure.passwords=true {
if (password != null) {
forcePassword(user,password)
} else {
if secure.passwords.allowblank {
if (unsetpassword) {
forcePassword(user,"")
}
} else {
// Skip, no changes
}
}
}
Modify user-form.vm, add a checkbox next to password (if
secure.passwords.allowblank=true) eg, Unset Password
---------------------------------------------------------------------
JIRA INFORMATION:
This message is automatically generated by JIRA.
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
