Openbravo Issue Tracking System - Openbravo ERP |
View Issue Details |
|
ID | Project | Category | View Status | Date Submitted | Last Update |
0041757 | Openbravo ERP | C. Security | public | 2019-09-05 09:57 | 2019-12-12 23:01 |
|
Reporter | alostale | |
Assigned To | alostale | |
Priority | normal | Severity | minor | Reproducibility | have not tried |
Status | closed | Resolution | fixed | |
Platform | | OS | 5 | OS Version | |
Product Version | | |
Target Version | | Fixed in Version | 3.0PR20Q1 | |
Merge Request Status | |
Review Assigned To | caristu |
OBNetwork customer | |
Web browser | |
Modules | Core |
Support ticket | |
Regression level | |
Regression date | |
Regression introduced in release | |
Regression introduced by commit | |
Triggers an Emergency Pack | No |
|
Summary | 0041757: improve password storage in DB |
Description | Refactor how password are stored in DB to use SHA-512 with salt instead of SHA-1. |
Steps To Reproduce | Project defintion: https://docs.google.com/spreadsheets/d/1QNIfhYLDIdgdHJCbdTHXad38mWWBcb9bVl95nMuWz-Q/edit#gid=1126234781 [^] |
Proposed Solution | |
Additional Information | |
Tags | No tags attached. |
Relationships | depends on | defect | 0041957 | | closed | alostale | API changes for improved password storage | related to | design defect | 0041758 | | acknowledged | Triage Platform Base | remove obsolte encryption columns |
|
Attached Files | |
|
Issue History |
Date Modified | Username | Field | Change |
2019-09-05 09:57 | alostale | New Issue | |
2019-09-05 09:57 | alostale | Assigned To | => platform |
2019-09-05 09:57 | alostale | Modules | => Core |
2019-09-05 09:57 | alostale | Triggers an Emergency Pack | => No |
2019-09-05 10:02 | alostale | Relationship added | related to 0041758 |
2019-10-09 10:02 | alostale | Relationship added | depends on 0041957 |
2019-10-09 10:02 | alostale | Assigned To | platform => alostale |
2019-10-09 10:02 | alostale | Review Assigned To | => caristu |
2019-10-09 10:18 | hgbot | Checkin | |
2019-10-09 10:18 | hgbot | Note Added: 0114975 | |
2019-10-09 10:18 | hgbot | Status | new => resolved |
2019-10-09 10:18 | hgbot | Resolution | open => fixed |
2019-10-09 10:18 | hgbot | Fixed in SCM revision | => http://code.openbravo.com/erp/devel/pi/rev/2e7550a9ae5e58ea54d6f645b261f4027cad0c7b [^] |
2019-10-09 10:25 | hgbot | Checkin | |
2019-10-09 10:25 | hgbot | Note Added: 0114977 | |
2019-10-09 10:28 | hgbot | Checkin | |
2019-10-09 10:28 | hgbot | Note Added: 0114978 | |
2019-10-09 10:34 | hgbot | Checkin | |
2019-10-09 10:34 | hgbot | Note Added: 0114979 | |
2019-10-09 10:34 | hgbot | Checkin | |
2019-10-09 10:34 | hgbot | Note Added: 0114980 | |
2019-10-09 10:35 | hgbot | Checkin | |
2019-10-09 10:35 | hgbot | Note Added: 0114981 | |
2019-10-09 10:41 | hgbot | Checkin | |
2019-10-09 10:41 | hgbot | Note Added: 0114982 | |
2019-10-09 10:46 | hgbot | Checkin | |
2019-10-09 10:46 | hgbot | Note Added: 0114983 | |
2019-10-09 10:51 | hgbot | Checkin | |
2019-10-09 10:51 | hgbot | Note Added: 0114984 | |
2019-10-09 10:52 | hgbot | Checkin | |
2019-10-09 10:52 | hgbot | Note Added: 0114985 | |
2019-10-09 11:02 | hgbot | Checkin | |
2019-10-09 11:02 | hgbot | Note Added: 0114986 | |
2019-10-09 16:14 | hgbot | Checkin | |
2019-10-09 16:14 | hgbot | Note Added: 0114991 | |
2019-10-18 09:20 | caristu | Note Added: 0115160 | |
2019-10-18 09:20 | caristu | Status | resolved => closed |
2019-10-18 09:20 | caristu | Fixed in Version | => 3.0PR20Q1 |
2019-12-12 23:01 | hudsonbot | Checkin | |
2019-12-12 23:01 | hudsonbot | Note Added: 0116237 | |
Notes |
|
(0114975)
|
hgbot
|
2019-10-09 10:18
|
|
Repository: erp/devel/pi
Changeset: 2e7550a9ae5e58ea54d6f645b261f4027cad0c7b
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Wed Oct 09 10:16:50 2019 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/2e7550a9ae5e58ea54d6f645b261f4027cad0c7b [^]
fixes 41757: [pwd] improve password storage in DB
---
M modules/org.openbravo.client.application/src/org/openbravo/client/application/navigationbarcomponents/UserInfoWidgetActionHandler.java
M modules/org.openbravo.service.json/src/org/openbravo/service/json/JsonToDataConverter.java
M referencedata/sampledata/F_B_International_Group/AD_USER.xml
M referencedata/sampledata/QA_Testing/AD_USER.xml
M src-core/src/org/openbravo/utils/FormatUtilities.java
M src-db/database/model/tables/AD_USER.xml
M src-db/database/sourcedata/AD_COLUMN.xml
M src-db/database/sourcedata/AD_REFERENCE.xml
M src-db/database/sourcedata/referencedData/AD_USER.xml
M src-test/src/org/openbravo/test/AllAntTaskTests.java
M src/org/openbravo/base/model/domaintype/HashedStringDomainType.java
M src/org/openbravo/base/secureApp/LoginHandler.java
M src/org/openbravo/base/secureApp/LoginUtils.java
M src/org/openbravo/erpCommon/businessUtility/InitialClientSetup.java
M src/org/openbravo/erpCommon/businessUtility/InitialOrgSetup.java
M src/org/openbravo/erpCommon/businessUtility/InitialSetupUtility.java
M src/org/openbravo/portal/GrantPortalAccessProcess.java
A src-test/src/org/openbravo/authentication/hashing/PasswordHashing.java
A src/org/openbravo/authentication/hashing/HashingAlgorithm.java
A src/org/openbravo/authentication/hashing/PasswordHash.java
A src/org/openbravo/authentication/hashing/SHA1.java
A src/org/openbravo/authentication/hashing/SHA512Salt.java
R src-core/src/org/openbravo/utils/CryptoSHA1BASE64.java
---
|
|
|
(0114977)
|
hgbot
|
2019-10-09 10:25
|
|
Repository: erp/pmods/org.openbravo.mobile.core
Changeset: 42f8d0dcd6d30f44e36f8ec6b1c34b9ce4b69c6c
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Wed Oct 09 10:24:30 2019 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.mobile.core/rev/42f8d0dcd6d30f44e36f8ec6b1c34b9ce4b69c6c [^]
related to issue 41757: [pwd] improved password storage in DB
Using same algorithm than in backend for offline storage
---
M src/org/openbravo/mobile/core/MobileCoreComponentProvider.java
M web/org.openbravo.mobile.core/source/data/ob-model.js
M web/org.openbravo.mobile.core/source/model/ob-terminal-model.js
A web/org.openbravo.mobile.core/source/model/ob-password-hash.js
---
|
|
|
(0114978)
|
hgbot
|
2019-10-09 10:28
|
|
Repository: erp/pmods/org.openbravo.retail.posterminal
Changeset: e1d625dcab54ca00764de2cdfb1176b9d9ba5174
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Wed Oct 09 10:28:24 2019 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.retail.posterminal/rev/e1d625dcab54ca00764de2cdfb1176b9d9ba5174 [^]
related to issue 41757: [pwd] improved password storage in DB
Using new algorithms hashing algorithm for approvals
---
M src/org/openbravo/retail/posterminal/utility/CheckApproval.java
M web/org.openbravo.retail.posterminal/js/utils/ob-utilitiesuipos.js
---
|
|
|
(0114979)
|
hgbot
|
2019-10-09 10:34
|
|
|
|
(0114980)
|
hgbot
|
2019-10-09 10:34
|
|
|
|
(0114981)
|
hgbot
|
2019-10-09 10:35
|
|
|
|
(0114982)
|
hgbot
|
2019-10-09 10:41
|
|
|
|
(0114983)
|
hgbot
|
2019-10-09 10:46
|
|
Repository: erp/pmods/org.openbravo.warehouse.advancedwarehouseoperations
Changeset: cd561f716be45ca3763ff8e3b3ccbd3489219a33
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Wed Oct 09 10:44:57 2019 +0200
URL: http://code.openbravo.com/erp/pmods/org.openbravo.warehouse.advancedwarehouseoperations/rev/cd561f716be45ca3763ff8e3b3ccbd3489219a33 [^]
related to issue 41757: [pwd] using new algorithm for AWO approvals
---
M legal/OBC_license.txt
M src/org/openbravo/warehouse/advancedwarehouseoperations/mobile/OBAWOComponentProvider.java
M src/org/openbravo/warehouse/advancedwarehouseoperations/mobile/OBAWOLoginUtilsServlet.java
M web/org.openbravo.warehouse.advancedwarehouseoperations/assets/css/obawo-login.css
M web/org.openbravo.warehouse.advancedwarehouseoperations/assets/css/obawo-styles.css
M web/org.openbravo.warehouse.advancedwarehouseoperations/index.jsp
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/box/obawo-box-view.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/ob-attvalue-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/ob-locator-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-boxunboxsharedcomponents.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-deltaapproval.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-inventory-lookup.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-issues-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-menu.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-physicalinventory-productselector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-picking-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-putaway-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-receipt-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-reference-creator.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-reference-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-referencetype-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-sdswap-sdselector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-task-panel.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-tasks-doubleconfirmation.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-tasks-lefttoolbar.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-tasks-manageqty.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-tasks-rightpanel.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/components/obawo-tasks-selector.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/groupedlisttasks/components/obawo-groupedtasks-tasksbrowser.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/groupedlisttasks/obawo-groupedtasks-view.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/maintasks/components/obawo-tasks-tasksbrowser.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/maintasks/obawo-tasks-view.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/physicalinventorycount/components/obawo-physicalinventorycount-pip.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/physicalinventorycount/obawo-physicalinventorycount-view.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/terminal/obawo-terminal.js
M web/org.openbravo.warehouse.advancedwarehouseoperations/source/unbox/obawo-unbox-view.js
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/css/obawo-legacy.css
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/BACKGROUND-InDevelopment.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/BACKGROUND-PNG24.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/BACKGROUND.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/OBLogo-small.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/OBLogo.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/OpenbravoLoginLogo.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/Warning.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/anonymous-icon.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/box.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/checkBlack.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/checkDoubleBlack.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/checkbox-alt-half-on.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/checkbox-alt-on.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/checkbox-half-on.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/checkbox-off.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/checkbox-on.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/dots-icon-2col.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/dots-icon.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/fullyReturned.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconAdd.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconAwayUser.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconAwayUser.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconBackspace.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconCanceled.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconCheck.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconClear.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconClearPaidTicket.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconClearPayment.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconCollapse.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconContextualButton.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconCreateNew-alt.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconCreateNew.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconDelete.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconDropdown.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconDropdownArrow.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconEdit.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconEnter.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconExpand.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconMenu.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconNotSynchronized.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconOffline.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconOfflineUser.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconOfflineUser.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconOnline.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconOnlineUser.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconPrint.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconRFIDOFF.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconRFIDON.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconRFIDOffline.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconReturned.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconReversePayment.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSearch.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSearch.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSelectorRemove.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSelectorSortAscending.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSelectorSortDescending.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSelectorSortDisabled.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSubstract.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSwitchOFF.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSwitchON.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSwitchOffline.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconSync.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconWorkspace.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/iconloading.gif
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/info-icon-plus.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/info-icon.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/inspectTree.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/ioswebapp120x120.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/ioswebapp128x128.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/ioswebapp152x152.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/ioswebapp196x196.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/ioswebapp60x60.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/ioswebapp76x76.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/loading-bar.gif
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/mobilewebapp120x120.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/mobilewebapp128x128.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/mobilewebapp152x152.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/mobilewebapp196x196.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/mobilewebapp60x60.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/mobilewebapp76x76.png
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/printer.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/radio-off.svg
A web/org.openbravo.warehouse.advancedwarehouseoperations/assets/img-legacy/radio-on.svg
---
|
|
|
(0114984)
|
hgbot
|
2019-10-09 10:51
|
|
|
|
(0114985)
|
hgbot
|
2019-10-09 10:52
|
|
|
|
(0114986)
|
hgbot
|
2019-10-09 11:02
|
|
Repository: erp/devel/pi
Changeset: 9765dea5db5cf2212270cfad92355b5235a67276
Author: Asier Lostalé <asier.lostale <at> openbravo.com>
Date: Wed Oct 09 11:02:13 2019 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/9765dea5db5cf2212270cfad92355b5235a67276 [^]
related to issue 41757: minor fixes
* Fixed some typos
* Use java.lang.IllegalStateException instead of org.jboss.weld.exceptions.IllegalStateException
---
M src-core/src/org/openbravo/utils/FormatUtilities.java
M src/org/openbravo/authentication/hashing/HashingAlgorithm.java
M src/org/openbravo/authentication/hashing/PasswordHash.java
M src/org/openbravo/authentication/hashing/SHA1.java
M src/org/openbravo/authentication/hashing/SHA512Salt.java
---
|
|
|
(0114991)
|
hgbot
|
2019-10-09 16:14
|
|
|
|
|
|
|
|
|