-
Type:
Bug
-
Status: Resolved
-
Priority:
Minor
-
Resolution: Fixed
-
Affects Version/s: 10.10
-
Fix Version/s: 10.10-HF60, 2021.19
-
Component/s: User Profile / User Manager
-
Release Notes Summary:Setting a password which doesn't respect the configured pattern results in a bad request error.
-
Tags:
-
Backlog priority:700
-
Sprint:nxplatform #59
-
Story Points:3
Steps to reproduce:
- Contribute a user password pattern for example
<extension point="userManager" target="org.nuxeo.ecm.platform.usermanager.UserService"> <userManager class="org.nuxeo.ecm.platform.computedgroups.UserManagerWithComputedGroups"> <userPasswordPattern>^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^+=])(?=\S+$).{8,}$</userPasswordPattern> </userManager> </extension>
- Start Nuxeo
- Log in to Nuxeo WebUI
- Go to Administration > Users & Groups > New > User
- Fill the different fields and set the password with "qsd"
- Submit
Observe that nothing happens.
In Nuxeo logs, there is this error
2021-03-19T11:31:09,485 ERROR [WebEngineExceptionMapper] org.nuxeo.ecm.platform.usermanager.exceptions.InvalidPasswordException org.nuxeo.ecm.platform.usermanager.exceptions.InvalidPasswordException: null at org.nuxeo.ecm.platform.usermanager.UserManagerImpl.checkPasswordValidity(UserManagerImpl.java:1392) ~[nuxeo-platform-usermanager-core-10.10-HF39.jar:?] at org.nuxeo.ecm.platform.usermanager.UserManagerImpl.createUser(UserManagerImpl.java:1346) ~[nuxeo-platform-usermanager-core-10.10-HF39.jar:?] at org.nuxeo.ecm.platform.usermanager.UserManagerImpl.createUser(UserManagerImpl.java:911) ~[nuxeo-platform-usermanager-core-10.10-HF39.jar:?] at org.nuxeo.ecm.restapi.server.jaxrs.usermanager.UserRootObject.createArtifact(UserRootObject.java:65) ~[nuxeo-rest-api-server-10.10-HF42.jar:?] at org.nuxeo.ecm.restapi.server.jaxrs.usermanager.UserRootObject.createArtifact(UserRootObject.java:40) ~[nuxeo-rest-api-server-10.10-HF42.jar:?] at org.nuxeo.ecm.restapi.server.jaxrs.usermanager.AbstractUMRootObject.createNew(AbstractUMRootObject.java:68) ~[nuxeo-rest-api-server-10.10-HF42.jar:?]
which produces a HTTP 500 response.
It can be reproduced with a curl command
curl -X POST -u Administrator:Administrator 'http://localhost:8080/nuxeo/api/v1/user' \ -H 'properties: *' \ -H 'Content-Type: application/json' \ -H 'Origin: http://localhost:8080' \ --data-raw '{"entity-type":"user","id":"","properties":{"username":"testpass","firstName":"tit","lastName":"mar","company":"","email":"tma@nuxeo.com","password":"qsd"}}'
returns
{"entity-type":"exception","status":500,"message":null}
Expected behavior: an error message is displayed to indicate that the entered password does not follow the required pattern
- is required by
-
-
- Resolved
-
