db-derby-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From kahat...@apache.org
Subject svn commit: r1220685 - in /db/derby/code/trunk/java: engine/org/apache/derby/iapi/services/property/PropertyValidation.java testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/AuthenticationTest.java
Date Mon, 19 Dec 2011 11:02:42 GMT
Author: kahatlen
Date: Mon Dec 19 11:02:42 2011
New Revision: 1220685

URL: http://svn.apache.org/viewvc?rev=1220685&view=rev
Log:
DERBY-5507: Orderly shutdown fails if you are using BUILTIN authentication and turn on derby.database.propertiesOnly

Make sure passwords are mapped to a hashed token before they are stored
in the database, also if the password is already defined in a system
property.

Modified:
    db/derby/code/trunk/java/engine/org/apache/derby/iapi/services/property/PropertyValidation.java
    db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/AuthenticationTest.java

Modified: db/derby/code/trunk/java/engine/org/apache/derby/iapi/services/property/PropertyValidation.java
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/engine/org/apache/derby/iapi/services/property/PropertyValidation.java?rev=1220685&r1=1220684&r2=1220685&view=diff
==============================================================================
--- db/derby/code/trunk/java/engine/org/apache/derby/iapi/services/property/PropertyValidation.java
(original)
+++ db/derby/code/trunk/java/engine/org/apache/derby/iapi/services/property/PropertyValidation.java
Mon Dec 19 11:02:42 2011
@@ -61,6 +61,9 @@ public class PropertyValidation implemen
 					if (!psc.validate(key, value, d))
 						continue;
 
+					if (mappedValue == null)
+ 						mappedValue = psc.map(key, value, d);
+
 					// if this property should not be used then
 					// don't call apply. This depends on where
 					// the old value comes from
@@ -77,8 +80,6 @@ public class PropertyValidation implemen
 					Serviceable s;
 					if ((s = psc.apply(key,value,d)) != null)
 						((TransactionManager) tc).addPostCommitWork(s);
-					if (mappedValue == null)
- 						mappedValue = psc.map(key, value, d);
 				}
 			}
 		}

Modified: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/AuthenticationTest.java
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/AuthenticationTest.java?rev=1220685&r1=1220684&r2=1220685&view=diff
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/AuthenticationTest.java
(original)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/jdbcapi/AuthenticationTest.java
Mon Dec 19 11:02:42 2011
@@ -121,6 +121,9 @@ public class AuthenticationTest extends 
         test = new AuthenticationTest("testDefaultHashAlgorithm");
         setBaseProps(suite, test);
 
+        test = new AuthenticationTest("testDerby5507PlaintextPassword");
+        setBaseProps(suite, test);
+
         // The test cases below test the configurable hash authentication
         // mechanism added in DERBY-4483. Set the property that specifies the
         // hash algorithm to some valid value for these tests. Not all tests
@@ -1214,6 +1217,25 @@ public class AuthenticationTest extends 
             }
         }
     }
+
+    /**
+     * DERBY-5507: Setting a user's password as a database property, when
+     * that user's password is already set as a system property, used to make
+     * the password getting stored in plaintext in the database.
+     */
+    public void testDerby5507PlaintextPassword() throws SQLException {
+        // This user account is defined in a system property
+        String key = "derby.user.mickey";
+
+        // Now define the account in a database property
+        String pw = "M0u$e";
+        setDatabaseProperty(key, pw);
+
+        // This used to return the plaintext password, but it should
+        // return a hashed token
+        String pwToken = getDatabaseProperty(key);
+        assertFalse("Password stored in plaintext", pwToken.equals(pw));
+    }
     
     protected void assertFailSetDatabaseProperty(
         String propertyName, String value, Connection conn) 



Mime
View raw message