From 80a782145222b9a8ae91acff4003e2731a7e5053 Mon Sep 17 00:00:00 2001 From: desoliture Date: Wed, 8 Dec 2021 17:58:14 +0200 Subject: [PATCH 1/5] fix "password is empty" on only-white-spaces password --- .../service/security/auth/rest/RestLoginProcessingFilter.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestLoginProcessingFilter.java b/application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestLoginProcessingFilter.java index 76c0cd7a87..f9dbac87e9 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestLoginProcessingFilter.java +++ b/application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestLoginProcessingFilter.java @@ -73,7 +73,7 @@ public class RestLoginProcessingFilter extends AbstractAuthenticationProcessingF throw new AuthenticationServiceException("Invalid login request payload"); } - if (StringUtils.isBlank(loginRequest.getUsername()) || StringUtils.isBlank(loginRequest.getPassword())) { + if (StringUtils.isBlank(loginRequest.getUsername()) || StringUtils.isEmpty(loginRequest.getPassword())) { throw new AuthenticationServiceException("Username or Password not provided"); } From 409fddc2e89a26eeebc75a9bf9aad718e9e0db35 Mon Sep 17 00:00:00 2001 From: desoliture Date: Fri, 10 Dec 2021 18:05:20 +0200 Subject: [PATCH 2/5] add password policy for white-spaces --- .../service/security/system/DefaultSystemSecurityService.java | 4 ++++ .../server/common/data/security/model/UserPasswordPolicy.java | 2 ++ 2 files changed, 6 insertions(+) diff --git a/application/src/main/java/org/thingsboard/server/service/security/system/DefaultSystemSecurityService.java b/application/src/main/java/org/thingsboard/server/service/security/system/DefaultSystemSecurityService.java index 5db9509a77..26f6dbab65 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/system/DefaultSystemSecurityService.java +++ b/application/src/main/java/org/thingsboard/server/service/security/system/DefaultSystemSecurityService.java @@ -27,6 +27,7 @@ import org.passay.PasswordData; import org.passay.PasswordValidator; import org.passay.Rule; import org.passay.RuleResult; +import org.passay.WhitespaceRule; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.cache.annotation.CacheEvict; import org.springframework.cache.annotation.Cacheable; @@ -174,6 +175,9 @@ public class DefaultSystemSecurityService implements SystemSecurityService { if (isPositiveInteger(passwordPolicy.getMinimumSpecialCharacters())) { passwordRules.add(new CharacterRule(EnglishCharacterData.Special, passwordPolicy.getMinimumSpecialCharacters())); } + if (!passwordPolicy.getAllowWhitespaces()) { + passwordRules.add(new WhitespaceRule()); + } PasswordValidator validator = new PasswordValidator(passwordRules); PasswordData passwordData = new PasswordData(password); RuleResult result = validator.validate(passwordData); diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java index 28bdae82c3..8648f9839f 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java @@ -35,6 +35,8 @@ public class UserPasswordPolicy implements Serializable { private Integer minimumDigits; @ApiModelProperty(position = 1, value = "Minimum number of special in the password." ) private Integer minimumSpecialCharacters; + @ApiModelProperty(position = 1, value = "Allow white-spaces") + private Boolean allowWhitespaces; @ApiModelProperty(position = 1, value = "Password expiration period (days). Force expiration of the password." ) private Integer passwordExpirationPeriodDays; From bbecb26023cb41aa91918cb979fe018da9626460 Mon Sep 17 00:00:00 2001 From: desoliture Date: Tue, 14 Dec 2021 11:35:09 +0200 Subject: [PATCH 3/5] add default value to password rule "allow whitespaces" - true --- .../server/common/data/security/model/UserPasswordPolicy.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java index 8648f9839f..1e4aeb0055 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java @@ -36,7 +36,7 @@ public class UserPasswordPolicy implements Serializable { @ApiModelProperty(position = 1, value = "Minimum number of special in the password." ) private Integer minimumSpecialCharacters; @ApiModelProperty(position = 1, value = "Allow white-spaces") - private Boolean allowWhitespaces; + private Boolean allowWhitespaces = true; @ApiModelProperty(position = 1, value = "Password expiration period (days). Force expiration of the password." ) private Integer passwordExpirationPeriodDays; From 86ba65f2a4857df5b842fdda98f3c60799971129 Mon Sep 17 00:00:00 2001 From: Kalutka Zhenya Date: Tue, 14 Dec 2021 11:39:25 +0200 Subject: [PATCH 4/5] Added UI for Allow whitespace --- .../modules/home/pages/admin/security-settings.component.html | 3 +++ .../modules/home/pages/admin/security-settings.component.ts | 3 ++- ui-ngx/src/app/shared/models/settings.models.ts | 1 + ui-ngx/src/assets/locale/locale.constant-en_US.json | 1 + 4 files changed, 7 insertions(+), 1 deletion(-) diff --git a/ui-ngx/src/app/modules/home/pages/admin/security-settings.component.html b/ui-ngx/src/app/modules/home/pages/admin/security-settings.component.html index a9051f793b..d3bf5757f1 100644 --- a/ui-ngx/src/app/modules/home/pages/admin/security-settings.component.html +++ b/ui-ngx/src/app/modules/home/pages/admin/security-settings.component.html @@ -139,6 +139,9 @@ {{ 'admin.password-reuse-frequency-days-range' | translate }} + + admin.allow-whitespace + diff --git a/ui-ngx/src/app/modules/home/pages/admin/security-settings.component.ts b/ui-ngx/src/app/modules/home/pages/admin/security-settings.component.ts index 6824ce8c3e..28051eacd6 100644 --- a/ui-ngx/src/app/modules/home/pages/admin/security-settings.component.ts +++ b/ui-ngx/src/app/modules/home/pages/admin/security-settings.component.ts @@ -63,7 +63,8 @@ export class SecuritySettingsComponent extends PageComponent implements OnInit, minimumDigits: [null, Validators.min(0)], minimumSpecialCharacters: [null, Validators.min(0)], passwordExpirationPeriodDays: [null, Validators.min(0)], - passwordReuseFrequencyDays: [null, Validators.min(0)] + passwordReuseFrequencyDays: [null, Validators.min(0)], + allowWhitespaces: [true] } ) }); diff --git a/ui-ngx/src/app/shared/models/settings.models.ts b/ui-ngx/src/app/shared/models/settings.models.ts index 8b2d4aac78..b130bb6338 100644 --- a/ui-ngx/src/app/shared/models/settings.models.ts +++ b/ui-ngx/src/app/shared/models/settings.models.ts @@ -55,6 +55,7 @@ export interface UserPasswordPolicy { minimumDigits: number; minimumSpecialCharacters: number; passwordExpirationPeriodDays: number; + allowWhitespaces: boolean; } export interface SecuritySettings { diff --git a/ui-ngx/src/assets/locale/locale.constant-en_US.json b/ui-ngx/src/assets/locale/locale.constant-en_US.json index 3ee86c15d6..a2ad663f90 100644 --- a/ui-ngx/src/assets/locale/locale.constant-en_US.json +++ b/ui-ngx/src/assets/locale/locale.constant-en_US.json @@ -152,6 +152,7 @@ "password-expiration-period-days-range": "Password expiration period in days can't be negative", "password-reuse-frequency-days": "Password reuse frequency in days", "password-reuse-frequency-days-range": "Password reuse frequency in days can't be negative", + "allow-whitespace": "Allow whitespace", "general-policy": "General policy", "max-failed-login-attempts": "Maximum number of failed login attempts, before account is locked", "minimum-max-failed-login-attempts-range": "Maximum number of failed login attempts can't be negative", From f2d6ed1e8570b405ce40249585aa36334184d3f5 Mon Sep 17 00:00:00 2001 From: desoliture Date: Thu, 16 Dec 2021 10:39:01 +0200 Subject: [PATCH 5/5] refactoring --- .../service/security/system/DefaultSystemSecurityService.java | 2 +- .../server/common/data/security/model/UserPasswordPolicy.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/application/src/main/java/org/thingsboard/server/service/security/system/DefaultSystemSecurityService.java b/application/src/main/java/org/thingsboard/server/service/security/system/DefaultSystemSecurityService.java index 26f6dbab65..aaf6fecd9b 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/system/DefaultSystemSecurityService.java +++ b/application/src/main/java/org/thingsboard/server/service/security/system/DefaultSystemSecurityService.java @@ -175,7 +175,7 @@ public class DefaultSystemSecurityService implements SystemSecurityService { if (isPositiveInteger(passwordPolicy.getMinimumSpecialCharacters())) { passwordRules.add(new CharacterRule(EnglishCharacterData.Special, passwordPolicy.getMinimumSpecialCharacters())); } - if (!passwordPolicy.getAllowWhitespaces()) { + if (passwordPolicy.getAllowWhitespaces() != null && !passwordPolicy.getAllowWhitespaces()) { passwordRules.add(new WhitespaceRule()); } PasswordValidator validator = new PasswordValidator(passwordRules); diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java index 1e4aeb0055..7201df78b5 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/UserPasswordPolicy.java @@ -35,7 +35,7 @@ public class UserPasswordPolicy implements Serializable { private Integer minimumDigits; @ApiModelProperty(position = 1, value = "Minimum number of special in the password." ) private Integer minimumSpecialCharacters; - @ApiModelProperty(position = 1, value = "Allow white-spaces") + @ApiModelProperty(position = 1, value = "Allow whitespaces") private Boolean allowWhitespaces = true; @ApiModelProperty(position = 1, value = "Password expiration period (days). Force expiration of the password." )