Disallow plain webAdminPassword values to force usage of hashes by katzyn · Pull Request #3833 · h2database/h2database (original) (raw)

webAdminPassword setting allowed both clear-text passwords and hashes of salted passwords from the beginning, but there were no documented methods for generation of such hashes. It was possible to write a clear-text password to configuration file and then save settings of H2 Console from H2 Console itself to get a configuration file with hashed password, but this way wasn't documented either.

1. A new public method is added and documented for this purpose. This method requires at least 12 characters for more safety.
2. Clear-text passwords from all sources are not accepted any more. Old installations with password hashes in configuration files will continue to work after this change.
3. runTool() method still allows this parameter to be passed (now only with salted hash), but main() method rejects this parameter to make these strange people happy.

(This setting is probably needed for less than 1% of users, why so many people think that it is something important?)

@grandinj