This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit 5e8ee0f31fcbfc4afa9d72ac246f773323319c3c Author: Robert Lazarski <[email protected]> AuthorDate: Wed Sep 2 17:19:44 2026 -1000 Stop publishing default admin console credentials AXIS2-6069 emptied the credentials in the configs the binary distribution uses, but two published files kept admin/axis2: conf/axis2.xml inside the axis2-webapp WAR, and axis2_default.xml inside axis2-kernel.jar, which is the classpath fallback every configurator uses when no axis2.xml is found. Both gave /axis2-admin a known login, and that console can upload services. Empty both; the admin console tests now inject credentials into their unpacked copy of the WAR instead. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .../org/apache/axis2/deployment/axis2_default.xml | 10 ++- modules/webapp/conf/axis2.xml | 13 +++- systests/webapp-tests/pom.xml | 75 +++++++++++++++++----- 3 files changed, 75 insertions(+), 23 deletions(-) diff --git a/modules/kernel/src/org/apache/axis2/deployment/axis2_default.xml b/modules/kernel/src/org/apache/axis2/deployment/axis2_default.xml index 70383a42c0..1c9ff9d744 100644 --- a/modules/kernel/src/org/apache/axis2/deployment/axis2_default.xml +++ b/modules/kernel/src/org/apache/axis2/deployment/axis2_default.xml @@ -39,9 +39,13 @@ <!--is set then, Axis2 tries to get the first exception and set its message as the faultreason/Reason.--> <parameter name="DrillDownToRootCauseForFaultReason">false</parameter> - <!--This is the user name and password of admin console--> - <parameter name="userName">admin</parameter> - <parameter name="password">axis2</parameter> + <!--The user name and password of the admin console. Empty on purpose: + this file ships inside axis2-kernel.jar and is the classpath fallback + every configurator uses when no axis2.xml is found, so any value here is + a published default credential. Leaving these blank disables the console + until an operator sets both.--> + <parameter name="userName"></parameter> + <parameter name="password"></parameter> <!--To override repository/services you need to uncomment following parameter and value SHOULD be absolute file path.--> <!--ServicesDirectory only works on the following cases--> diff --git a/modules/webapp/conf/axis2.xml b/modules/webapp/conf/axis2.xml index 922f1cfacf..23929d6223 100644 --- a/modules/webapp/conf/axis2.xml +++ b/modules/webapp/conf/axis2.xml @@ -129,9 +129,16 @@ <!--is set, then Axis2 tries to get the first exception and set its message as the faultreason/Reason.--> <parameter name="DrillDownToRootCauseForFaultReason">false</parameter> - <!-- AXIS2-6069, leave this in for unit tests but don't distribute it --> - <parameter name="userName">admin</parameter> - <parameter name="password">axis2</parameter> + <!-- AXIS2-6069. Empty on purpose: this file ships inside the axis2-webapp + WAR, so any value here is a published default credential for the + /axis2-admin console, which can upload services and therefore execute + code. AdminActions.login rejects empty submitted credentials before + comparing, so leaving these blank disables the console until an + operator sets both. The admin-console integration tests inject their + own values into the unpacked WAR (see systests/webapp-tests/pom.xml); + do not restore literals here to make a test pass. --> + <parameter name="userName"></parameter> + <parameter name="password"></parameter> <!--To override repository/services you need to uncomment following parameter and value SHOULD be absolute file path.--> <!--ServicesDirectory only works on the following cases--> diff --git a/systests/webapp-tests/pom.xml b/systests/webapp-tests/pom.xml index 448af77897..5a1ea3c5d6 100644 --- a/systests/webapp-tests/pom.xml +++ b/systests/webapp-tests/pom.xml @@ -81,39 +81,80 @@ <artifactId>alta-maven-plugin</artifactId> <executions> <execution> - <id>war-location</id> + <id>aar-location</id> <goals> - <goal>generate-properties</goal> + <goal>generate-test-resources</goal> </goals> <configuration> - <name>webapp</name> + <name>echo-service-location.txt</name> <value>%file%</value> <artifactSet> <dependencySet> <scope>test</scope> <includes> - <include>*:axis2-webapp:war:*</include> + <include>*:echo:aar:*</include> </includes> </dependencySet> </artifactSet> </configuration> </execution> + </executions> + </plugin> + <plugin> + <artifactId>maven-dependency-plugin</artifactId> + <executions> <execution> - <id>aar-location</id> + <id>unpack-webapp</id> + <phase>process-test-resources</phase> <goals> - <goal>generate-test-resources</goal> + <goal>unpack</goal> </goals> <configuration> - <name>echo-service-location.txt</name> - <value>%file%</value> - <artifactSet> - <dependencySet> - <scope>test</scope> - <includes> - <include>*:echo:aar:*</include> - </includes> - </dependencySet> - </artifactSet> + <artifactItems> + <artifactItem> + <groupId>${project.groupId}</groupId> + <artifactId>axis2-webapp</artifactId> + <version>${project.version}</version> + <type>war</type> + <outputDirectory>${project.build.directory}/axis2-webapp</outputDirectory> + <!-- Unpack every run. Without this the plugin's marker file + skips the unpack on a rebuild, leaving the credentials + injected below already in place, and the guarded replace + then fails because it finds nothing to replace. --> + <overWrite>true</overWrite> + </artifactItem> + </artifactItems> + </configuration> + </execution> + </executions> + </plugin> + <plugin> + <artifactId>maven-antrun-plugin</artifactId> + <executions> + <execution> + <id>set-admin-credentials</id> + <phase>process-test-resources</phase> + <goals> + <goal>run</goal> + </goals> + <configuration> + <target> + <!-- The shipped axis2-webapp WAR deliberately carries no admin + credentials, which leaves the console disabled (see + modules/webapp/conf/axis2.xml). AxisAdminServletITCase needs a + console it can log into, so inject credentials into the + unpacked copy only. failOnNoReplacements keeps this honest: if + the shipped parameters ever change shape, this fails loudly + instead of silently testing a console nobody can log into. --> + <replace file="${project.build.directory}/axis2-webapp/WEB-INF/conf/axis2.xml" + token="<parameter name="userName"></parameter>" + value="<parameter name="userName">admin</parameter>" + failOnNoReplacements="true"/> + <replace file="${project.build.directory}/axis2-webapp/WEB-INF/conf/axis2.xml" + token="<parameter name="password"></parameter>" + value="<parameter name="password">axis2</parameter>" + failOnNoReplacements="true"/> + </target> </configuration> </execution> </executions> @@ -133,7 +174,7 @@ </daemonArtifact> <daemonConfiguration> <resourceBases> - <resourceBase>${webapp}</resourceBase> + <resourceBase>${project.build.directory}/axis2-webapp</resourceBase> </resourceBases> <contextPath>/axis2</contextPath> </daemonConfiguration>
