Bug: Disabled Password is never checked and user can log in

Hi,

in our portal a new created user has to confirm it's password via email.
So we set the password to NOT enabled after user creation:

  User user = userManager.getUser(userName);
  PasswordCredential pwc = userManager.getPasswordCredential(user);
  pwc.setEnabled(false);
  userManager.storePasswordCredential(pwc);

But the user can immediately log in, although the password is disabled.
I verified this in the database  (security_credential.IS_ENABLED = 0).

The bug seems to be in the
UserPasswordCredentialManagerImpl.getAuthenticatedPasswordCredential
where isEnabled() is never checked !

I attached a patch to resolve this problem.
Please verify.

Further we're looking forward to the Jetspeed 2.3 release, to use this one in our next portal release (in december/january).
Currently we're using the trunk.
Will there be a release soon ?

best regards,
	Martin

-- 

. frankfurt am main, 4°c, die gefühlte temperatur
  liegt bei 0°c. zur zeit ein wenig bewölkt in 61 m.
  die sichtweite reicht 8.0 km.

< martin maidhof
  [email protected]
  t +49 69 759003 14

  wemove digital solutions gmbh
  eschersheimer landstr. 5-7
  60322 frankfurt am main

  amtsgericht frankfurt am main, hrb 53992
  geschäftsführer joachim müller, stefan hartmann

  wemove digital solutions
  www.wemove.com


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Index: UserPasswordCredentialManagerImpl.java
===================================================================
--- UserPasswordCredentialManagerImpl.java	(revision 1644694)
+++ UserPasswordCredentialManagerImpl.java	(working copy)
@@ -88,15 +88,15 @@
                 {
                     upcsm.storePasswordCredential(credential);
                 }
-                if (!credential.isEnabled() || credential.isExpired())
-                {
-                    throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, userName));
-                }
-                else if (credential.getAuthenticationFailures() != 0)
-                {
-                    throw new SecurityException(SecurityException.INVALID_PASSWORD);
-                }
             }
+            if (!credential.isEnabled() || credential.isExpired())
+            {
+                throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, userName));
+            }
+            else if (credential.getAuthenticationFailures() != 0)
+            {
+                throw new SecurityException(SecurityException.INVALID_PASSWORD);
+            }
         }
         else
         {