#26889 Encrypt Pepper in Argon Hashing

enhancement

major

#26626

Systematic logging for Kafka

#26864

Force password change when administrator assigns password

#26893

Optional dependencies between services (ManagedClass)

#26905

Extinguishing callback at the subject object

#26920

Suggested values for number and string attributes

#26959

Drag&Drop: Generalization of the DropByExpression API

minor

#26549

Form tables: Customization standard columns

#26755

Update CKEditor to version 4.19.1

#26858

Reduce calls to ModelBuilder.supportsModel()

#26871

Simplified mail configuration for IMAPS and SMTPS

#26872

Selectable ID column on type

#26887

Specify database passwords encrypted

#26889

Encrypt Pepper in Argon Hashing

#26913

Improve performance when deleting multiple objects

#26917

Default selection for value suggestions: Options via printout

#26918

Prioritize implementations for in-app annotations

#26938

Allow configuring control tag and CSS classes for all configurable control renderers

#26946

Show resource path of the application in the environment variables

#26953

Icon library: Bootstrap Icons

nice-to-have

#26914

Alias and System Properties for ZooKeeper Port and Kafka Port

defect

minor

#23801

Label calculation in Excelexport does not consider table configuration

#24788

Missing deployment of top-logic.js and CSS for production mode

#25322

Form field for mandatory DateTime attribute incorrectly marked as changed

#25612

Model Editor displays link ends in the attribute table when references are changed

#25613

BPE: Creation of new process instances with mandatory fields not possible

#25652

In-app modeling: backreferences of compositions are created as multiple=true

#25732

Model-based search: Input validation: Filter query leads to NullpointerException

#25858

Model editor reloads page on script execution

#26396

Drag and Drop: Icon from table header to drop zone: NPE

#26406

WYSIWYG YouTube plugin has problems with embedding

#26441

No session invalidation during login and password change process

#26447

Reference checks: Are only checked in the form, not when committing

#26461

Overridden attribute inherits mandatory "Default value" customization

#26484

In-app template for grid and tables: Function "Verifier for use as list item" does not get component model

#26529

Model transfer to development environment: ResKeys remain in dynamic properties

#26554

Calculated web folder references delete folder when deleting the base object

#26569

Missing constraint violations when deleting objects referenced by mandatory fields

#26583

Encoding problems in system overload hint page

#26584

Wiki formatting in multiline text attributes / text fields broken

#26587

Option providers do not update calculated suggested values

#26691

Webfolder: Erroneous behavior of multiple upload file selection

#26730

Column definitions are not applied to composition tables

#26750

Prohibit drop from non-TL object to tables and trees

#26836

StackOverflow due to configuration error: Calculated string attribute returns integer

#26852

ApplicationTesting: No two sessions possible for the same user in JUnit test

#26853

EditComponent loses edit mode after deletion

#26856

Lack of documentation adaptation to new + context

#26857

Inconsistent "source" properties in documentation pages

#26859

Correct various Eclipse settings

#26865

Missing selection marker in composition tables

#26866

Instance Browser: New transient object does not show type

#26867

Configuration uses unencrypted SMTP and IMAP password

#26868

End animation when table is cleared from GUI

#26870

Inactive scheduler crashes the application

#26873

Application monitor "Environment variables" may display safety-critical values

#26874

Service Editor displays "secret" of the OpenID service

#26880

Selection of icons in the icon chooser is not scriptable

#26883

Drag preview image in script recorder does not use label

#26884

Declarative forms: Missing GUI update for programmatic changes of a list-valued property

#26885

Constraints on declarative forms with arguments from a container reference lead to errors for new elements

#26890

Overridden properties are not initialized correctly when booting from model definition

#26891

Jerky table contents in FrozenTables

#26894

Missing dependency ModelBasedSearch -> SearchBuilder

#26895

Missing dependency MailServer -> MailReceiverService

#26896

DnD: Drop operation with drop type "child" on table gets the wrong row object

#26903

Under unfavorable circumstances data from future revisions visible in AssociationCache's

#26904

CSS editor does not work with Top-Logic theme variables

#26906

Default annotations cannot be inherited from the attribute type

#26911

OutOfMemoryError on App-WAR generation

#26922

With generated subject classes, a default provider of an attribute in a non-structure class does not get a create context

#26923

ModelNamingSchemes do not get "value context" in some cases

#26924

Horizontally displayed radio button selection extends beyond form boundaries

#26925

BreadCrumbs do not update when inner tabbars are not visible

#26926

Rare ArrayIndexOutOfBoundsException on tab change

#26928

Hidden component does not appear anymore, although it gets a supported model

#26929

Scripting recorder: No templates are loaded in project demo

#26934

Update yFiles to version 2.4.0.6

#26939

Changed order of standard columns in new table

#26942

Frozen table: drag selection contains duplicates

#26945

Inconsistent lock timeout at application startup

#26957

No update of node properties after model change

#26960

Schedule: Automatic collision avoidance does not work

#26965

Theme icon with value "none" is not resolved correctly

#26972

Scripting recorder: stops execution after reloading the page

#26988

In-app documentation generator does not extract documentation for overwritten config properties

#26996

ChartJS Update to 3.9.1

#26997

JSoup Update to 1.15.3

#26998

Update Batik Graphics to 1.15

enhancement

minor

#26889

Encrypt Pepper in Argon Hashing

Migration SecurityIssue

To hash passwords, a "Pepper" can be configured in the application, which is incorporated into the hash. This makes it more difficult for an attacker to calculate a hash without this information.

This value should be specified in encrypted form in the configuration.

Code Migration

The value of the configuration com.top_logic.base.security.password.hashing.Argon2Hashing.Config#getPepper() must be encrypted (see the maintenance page EncodeConfigurationValues.jsp). Alternatively, the prefix unencrypted: can be used for the value.

Test

No test.