- notifications - lists.xwiki.org

[xwiki/xwiki-platform] b3010e: XWIKI-21571: Change default value of the reset pas...
by XWiki Notifications 27 Mar '24

27 Mar '24

Branch: refs/heads/backport-3012-to-stable-15.10.x Home: https://github.com/xwiki/xwiki-platform Commit: b3010eb004859b0e9906cf21b6c3300c64929f96 https://github.com/xwiki/xwiki-platform/commit/b3010eb004859b0e9906cf21b6c3… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2024-03-27 (Wed, 27 Mar 2024) Changed paths: M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/pom.xml M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/AllIT.java R xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ForgotUsernameIT.java R xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java R xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ResetPasswordRequestClass.xml M xwiki-platform-core/xwiki-platform-oldcore/src/main/resources/ApplicationResources.properties M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/pom.xml M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManager.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordRequestResponse.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/ResetPasswordRequestClassDocumentInitializer.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/resources/ApplicationResources.properties M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/resources/META-INF/components.txt M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManagerTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-script/src/main/java/org/xwiki/security/authentication/script/AuthenticationScriptService.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/pom.xml A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/xwiki-platform-security-authentication-test-docker/pom.xml A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/xwiki-platform-security-authentication-test-docker/src/test/it/org/xwiki/security/authentication/test/ui/AllIT.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/xwiki-platform-security-authentication-test-docker/src/test/it/org/xwiki/security/authentication/test/ui/ForgotUsernameIT.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/xwiki-platform-security-authentication-test-docker/src/test/it/org/xwiki/security/authentication/test/ui/ResetPasswordIT.java M xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm Log Message: ----------- XWIKI-21571: Change default value of the reset password token lifetime (#3012) Change the mechanism of the reset password token to not reset it at each verification code check, but only when the password is actually reset, and when its lifetime expired. Also provide a mandatory document initializer for the ResetPasswordRequest xclass. Change a bit more the logic: if the token lifetime configuration is set to 0 (which was the default) then we automatically remove the reset password request xobject at first wrong attempt (bad verification code): it will prevent any bruteforce attack. Then if there's a token lifetime configuration set, we don't remove the xobject when a bad attempt is performed: user might have used the wrong mail for example. But we do remove the xobject when it's expired. And if it's expired, or if the code was wrong, in both cases we immediately return an error. Move ResetPasswordIT and ForgotUserNameIT from administration-test-docker to a new module security-authentication-test-docker since it's related to security-authentication module now. --------- Co-authored-by: Manuel Leduc <manuel.leduc(a)xwiki.com> (cherry picked from commit b410dad402669c76b0dcec149b1e8bd334c541c4) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform]
by XWiki Notifications 27 Mar '24

27 Mar '24

Branch: refs/heads/XWIKI-21571 Home: https://github.com/xwiki/xwiki-platform To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] b410da: XWIKI-21571: Change default value of the reset pas...
by XWiki Notifications 27 Mar '24

27 Mar '24

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: b410dad402669c76b0dcec149b1e8bd334c541c4 https://github.com/xwiki/xwiki-platform/commit/b410dad402669c76b0dcec149b1e… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2024-03-27 (Wed, 27 Mar 2024) Changed paths: M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/pom.xml M xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/AllIT.java R xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ForgotUsernameIT.java R xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java R xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ResetPasswordRequestClass.xml M xwiki-platform-core/xwiki-platform-oldcore/src/main/resources/ApplicationResources.properties M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/pom.xml M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManager.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordRequestResponse.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/ResetPasswordRequestClassDocumentInitializer.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/resources/ApplicationResources.properties M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/resources/META-INF/components.txt M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManagerTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-script/src/main/java/org/xwiki/security/authentication/script/AuthenticationScriptService.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/pom.xml A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/xwiki-platform-security-authentication-test-docker/pom.xml A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/xwiki-platform-security-authentication-test-docker/src/test/it/org/xwiki/security/authentication/test/ui/AllIT.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/xwiki-platform-security-authentication-test-docker/src/test/it/org/xwiki/security/authentication/test/ui/ForgotUsernameIT.java A xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-test/xwiki-platform-security-authentication-test-docker/src/test/it/org/xwiki/security/authentication/test/ui/ResetPasswordIT.java M xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm Log Message: ----------- XWIKI-21571: Change default value of the reset password token lifetime (#3012) Change the mechanism of the reset password token to not reset it at each verification code check, but only when the password is actually reset, and when its lifetime expired. Also provide a mandatory document initializer for the ResetPasswordRequest xclass. Change a bit more the logic: if the token lifetime configuration is set to 0 (which was the default) then we automatically remove the reset password request xobject at first wrong attempt (bad verification code): it will prevent any bruteforce attack. Then if there's a token lifetime configuration set, we don't remove the xobject when a bad attempt is performed: user might have used the wrong mail for example. But we do remove the xobject when it's expired. And if it's expired, or if the code was wrong, in both cases we immediately return an error. Move ResetPasswordIT and ForgotUserNameIT from administration-test-docker to a new module security-authentication-test-docker since it's related to security-authentication module now. --------- Co-authored-by: Manuel Leduc <manuel.leduc(a)xwiki.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[xwiki/xwiki-platform] 612a55: XWIKI-21571: Change default value of the reset pas...
by XWiki Notifications 27 Mar '24

27 Mar '24

Branch: refs/heads/XWIKI-21571 Home: https://github.com/xwiki/xwiki-platform Commit: 612a55ebecc1b405b07125d8a3f32dc2aa5936d4 https://github.com/xwiki/xwiki-platform/commit/612a55ebecc1b405b07125d8a3f3… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2024-03-27 (Wed, 27 Mar 2024) Changed paths: M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/ResetPasswordRequestClassDocumentInitializer.java Log Message: ----------- XWIKI-21571: Change default value of the reset password token lifetime * Add missing since To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications

1 0

[jira@xwiki.org][Issue] (XWIKI-22040) Select tour step order has no name
by XWiki Notifications 27 Mar '24

27 Mar '24

1 0

[jira@xwiki.org][Issue] (XWIKI-21452) Macros info, success, warning and error are only distinguished by colors
by XWiki Notifications 27 Mar '24

27 Mar '24

1 0

[jira@xwiki.org][Issue] (XRENDERING-736) Macros info, success, warning and error are only distinguished by colors
by XWiki Notifications 27 Mar '24

27 Mar '24

1 0

[xwiki/xwiki-docker] b14a8c: XDOCKER-318: Upgrade LTS version to 15.10.8
by XWiki Notifications 27 Mar '24

27 Mar '24

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-docker Commit: b14a8c5e1f589358100d255be2e0132460c0252a https://github.com/xwiki/xwiki-docker/commit/b14a8c5e1f589358100d255be2e013… Author: Thomas Mortagne <thomas.mortagne(a)gmail.com> Date: 2024-03-27 (Wed, 27 Mar 2024) Changed paths: M 15/mariadb-tomcat/Dockerfile M 15/mysql-tomcat/Dockerfile M 15/postgres-tomcat/Dockerfile M build.gradle Log Message: ----------- XDOCKER-318: Upgrade LTS version to 15.10.8 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-docker/settings/notifications

1 0

[jira@xwiki.org][Issue] (XDOCKER-318) Upgrade LTS version to 15.10.8
by XWiki Notifications 27 Mar '24

27 Mar '24

1 0

[jira@xwiki.org][Issue] (XDOCKER-318) Upgrade LTS version to 15.10.8
by XWiki Notifications 27 Mar '24

27 Mar '24

1 0