Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disallow plain webAdminPassword values to force usage of hashes #3833

Merged
merged 1 commit into from Jul 3, 2023

Conversation

katzyn
Copy link
Contributor

@katzyn katzyn commented Jul 3, 2023

webAdminPassword setting allowed both clear-text passwords and hashes of salted passwords from the beginning, but there were no documented methods for generation of such hashes. It was possible to write a clear-text password to configuration file and then save settings of H2 Console from H2 Console itself to get a configuration file with hashed password, but this way wasn't documented either.

  1. A new public method is added and documented for this purpose. This method requires at least 12 characters for more safety.
  2. Clear-text passwords from all sources are not accepted any more. Old installations with password hashes in configuration files will continue to work after this change.
  3. runTool() method still allows this parameter to be passed (now only with salted hash), but main() method rejects this parameter to make these strange people happy.

(This setting is probably needed for less than 1% of users, why so many people think that it is something important?)

@grandinj

@grandinj
Copy link
Contributor

grandinj commented Jul 3, 2023

+1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants