Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SHIRO-887] Do not trim passwords in FormAuthenticationFilter #369

Merged

Conversation

sebastianfrey
Copy link

@sebastianfrey sebastianfrey commented Jul 25, 2022

Fixes SHIRO-887.

This PR fixes an issue where passwords which start and/or end with spaces are trimmed by the FormAuthenticationFilter, which prevents login for users with such passwords.

Note: I am a first time contributor, so I have no CLA signed yet. In order to fulfill the contribution guidelines, I have sent the signed CLA to the Apache Software Foundations secretary office.

Update 2022/07/30: CLA is acknowledge.


Following this checklist to help us incorporate your contribution quickly and easily:

  • Make sure there is a JIRA issue filed
    for the change (usually before you start working on it). Trivial changes like typos do not
    require a JIRA issue. Your pull request should address just this issue, without pulling in other changes.
  • Each commit in the pull request should have a meaningful subject line and body.
  • Format the pull request title like [SHIRO-XXX] - Fixes bug in SessionManager,
    where you replace SHIRO-XXX with the appropriate JIRA issue. Best practice
    is to use the JIRA issue title in the pull request title and in the first line of the commit message.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Run mvn clean install apache-rat:check to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
  • If you have a group of commits related to the same change, please squash your commits into one and force push your branch using git rebase -i.

Trivial changes like typos do not require a JIRA issue (javadoc, comments...).
In this case, just format the pull request title like (DOC) - Add javadoc in SessionManager.

If this is your first contribution, you have to read the Contribution Guidelines

If your pull request is about ~20 lines of code you don't need to sign an Individual Contributor License Agreement
if you are unsure please ask on the developers list.

To make clear that you license your contribution under the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.

@sunshineandy
Copy link

sunshineandy commented Jul 25, 2022 via email

@bmarwell bmarwell changed the base branch from main to 1.9.x July 25, 2022 17:52
@bmarwell bmarwell changed the base branch from 1.9.x to main July 25, 2022 17:52
@bmarwell
Copy link
Contributor

Kindly re-target against 1.9.x instead. I cannot just change the branch here.

Rationale: detect signature change of public methods.

Copy link
Contributor

@bmarwell bmarwell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me. Will check the checks later and create a 1.10.x branch.

@fpapon
Copy link
Member

fpapon commented Jul 25, 2022

这是自动回复邮件。你好,您的邮件已经发送到我的邮箱,我看过后会尽快给您回复。

please write in english

@sebastianfrey sebastianfrey force-pushed the SHIRO-887-do-not-trim-password-strings branch from 8d93744 to 94461b3 Compare July 26, 2022 05:14
@sebastianfrey sebastianfrey changed the base branch from main to 1.10.x July 26, 2022 05:14
@sebastianfrey sebastianfrey force-pushed the SHIRO-887-do-not-trim-password-strings branch from 94461b3 to e47feeb Compare August 25, 2022 07:36
@bdemers bdemers merged commit c104ec5 into apache:1.10.x Oct 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants