-
Type: Bug
-
Status: Resolved
-
Priority: Critical
-
Resolution: Fixed
-
Affects Version/s: 5.4
-
Component/s: Digital Signature
-
Tags:
-
Backlog priority:1,000
-
Sprint:nxfit 8.3.3
-
Story Points:3
How to reproduce:
- install addon nuxeo-signature
- log in, navigate to HOME > Certificate
- Enter password and generate certificate
Password is stored in directory certificate without encryption (see column keypassword):
Backport in 6.0?
The following "override" contribution encrypts the password when stored in the directory:
<?xml version="1.0"?> <component name="digital.signature.directory.override"> <require>digital.signature.directory</require> <extension target="org.nuxeo.ecm.directory.sql.SQLDirectoryFactory" point="directories"> <directory name="certificate"> <schema>cert</schema> <dataSource>java:/nxsqldirectory</dataSource> <cacheTimeout>3600</cacheTimeout> <cacheMaxSize>1000</cacheMaxSize> <table>certificate</table> <idField>userid</idField> <passwordField>keypassword</passwordField> <passwordHashAlgorithm>SSHA</passwordHashAlgorithm> <autoincrementIdField>false</autoincrementIdField> <createTablePolicy>on_missing_columns</createTablePolicy> </directory> </extension> </component>