Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 25305cb0ef73968465529ed307dda66a249fab2d https://github.com/xwiki/xwiki-platform/commit/25305cb0ef73968465529ed307dda... Author: Simon Urli <simon.urli@xwiki.com> Date: 2026-08-31 (Mon, 31 Aug 2026) Changed paths: M pom.xml M xwiki-platform-core/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseCollection.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/PasswordClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/meta/PasswordMetaClass.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImpl.java A xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/migration/R180800000XWIKI24357DataMigration.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/internal/objects/PasswordPropertyParser.java A xwiki-platform-core/xwiki-platform-oldcore/src/main/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoder.java M xwiki-platform-core/xwiki-platform-oldcore/src/main/resources/META-INF/components.txt M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImplTest.java A xwiki-platform-core/xwiki-platform-oldcore/src/test/java/org/xwiki/security/internal/XWikiLegacyPasswordEncoderTest.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/main/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManager.java M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authentication/xwiki-platform-security-authentication-default/src/test/java/org/xwiki/security/authentication/internal/DefaultResetPasswordManagerTest.java M xwiki-platform-distribution/xwiki-platform-distribution-ui/xwiki-platform-distribution-ui-admin-user/src/main/resources/XWiki/Admin.xml Log Message: ----------- XWIKI-24357: Provide new algorithms in PasswordClass Refactor PasswordClass to rely on Spring Security framework algorithms, format and PasswordEncoder interface. Those changes also provide a migration to re-encode existing passwords in DB with a stronger algorithm. * All previous algorithm for password hash computation in PasswordClass has been moved to the new XWikiLegacyPasswordEncoder which implements the PasswordEncoder interface provided by Spring Security: the same encoder is also used to re-encode the passwords in the migration * I simplified the API for checking if 2 passwords are matching by providing utility methods that allows to perform the check directly at an XObject level, without having to get the class property perform a cast etc * Most changes are obviously in PasswordClass where I added the support of the different algorithm and provided the logic to support both legacy and new formats, and added checks to issue warning when legacy or deprecated encodings are used Commit: 110ea01a992bc05f40f319ca3836809690d3a456 https://github.com/xwiki/xwiki-platform/commit/110ea01a992bc05f40f319ca38368... Author: Michael Hamann <michael.hamann@xwiki.com> Date: 2026-08-31 (Mon, 31 Aug 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/AbstractXWikiAuthService.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImplTest.java M xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.cfg.vm Log Message: ----------- XWIKI-22257: Hash the superadmin password * Support bcrypt-encrypted password hashes for superadmin. * Document bcrypt support in the configuration file. Commit: e5f6530c1aed2f392ad6d78a0f62af45fe991a9b https://github.com/xwiki/xwiki-platform/commit/e5f6530c1aed2f392ad6d78a0f62a... Author: Simon Urli <simon.urli@xwiki.com> Date: 2026-08-31 (Mon, 31 Aug 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/impl/xwiki/AbstractXWikiAuthService.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImplTest.java M xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.cfg.vm Log Message: ----------- XWIKI-22257: Hash the superadmin password * Reuse format and utilities provided by PasswordClass to validate superadmin password Compare: https://github.com/xwiki/xwiki-platform/compare/44c7da6959a4...e5f6530c1aed To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications