[JS1-516] UserUpdateAction re-encrypts encrypted password when secure.passwords=true

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.5
• Component/s: Security
• Environment: Database: Postgres; JVM: J2DSK 1.4.02_04; OS: Redhat 9.x/Windows XPSP2
• Assignee: Unassigned
• Reporter: Arthur D'Alessandro
• Created: 03/Sep/04 21:14
• Updated: 29/Apr/05 16:21

Description

UserUpdateAction re-encrypts encrypted password when secure.passwords=true

Thus making the edit user capability unusable unless the purpose was to also reset the password.

I've been throwing around something simple, such as:

services.JetspeedSecurity.secure.passwords.allowblank=true|false

UserUpdateAction.doUpdate: Null password is ok, depending on
if secure.passwords=true {
if (password != null)

{ forcePassword(user,password) }

else {
if secure.passwords.allowblank {
if (unsetpassword)

{ forcePassword(user,"") }

} else

{ // Skip, no changes }

}
}

Modify user-form.vm, add a checkbox next to password (if secure.passwords.allowblank=true) eg, Unset Password