Branch: refs/heads/stable-18.4.x Home: https://github.com/xwiki/xwiki-platform Commit: 15cfa89ec9d50d7f84d5c812b2a663309ee6bfb0 https://github.com/xwiki/xwiki-platform/commit/15cfa89ec9d50d7f84d5c812b2a66... Author: Simon Urli <simon.urli@xwiki.com> Date: 2026-08-31 (Mon, 31 Aug 2026) Changed paths: M pom.xml M xwiki-platform-core/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiUsersDocumentInitializer.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseCollection.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PasswordClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/meta/PasswordMetaClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImpl.java A xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/migration/R180405000XWIKI24357DataMigration.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/objects/PasswordPropertyParser.java A xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoder.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/resources/META-INF/components.txt M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImplTest.java A xwiki-platform-core/xwiki-platform-oldcore/src/test/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoderTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManager.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManagerTest.java M xwiki-platform-distribution/xwiki-platform-distribution-ui/xwiki-platform-distribution-ui-admin-user/src/main/resources/XWiki/Admin.xml Log Message: ----------- XWIKI-24357: Provide new algorithms in PasswordClass Refactor PasswordClass to rely on Spring Security framework algorithms, format and PasswordEncoder interface. Those changes also provide a migration to re-encode existing passwords in DB with a stronger algorithm. * All previous algorithm for password hash computation in PasswordClass has been moved to the new XWikiLegacyPasswordEncoder which implements the PasswordEncoder interface provided by Spring Security: the same encoder is also used to re-encode the passwords in the migration * I simplified the API for checking if 2 passwords are matching by providing utility methods that allows to perform the check directly at an XObject level, without having to get the class property perform a cast etc * Most changes are obviously in PasswordClass where I added the support of the different algorithm and provided the logic to support both legacy and new formats, and added checks to issue warning when legacy or deprecated encodings are used (cherry picked from commit 25305cb0ef73968465529ed307dda66a249fab2d) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications