apache / apache/grails-core

isDirty(), hasChanged() fails with Spring Security and MongoDB

Open
#15,894 0 comments 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Expected Behavior

If there is NO any update property on the User object when it's saving, then the isDirty() function should work as expected. The **UserPasswordEncoderListener.class** should prevent any enconding password.

### Actual Behaviour

The isDirty() function is not working on the **UserPasswordEncoderListener.class**, every time I save a user object that has NO updates always return true, causing an already encoded password to be re-encoded and thereby breaking authentication.

**User Controller**
In the UserController, testing the isDirty function worked as expected.
![Screen Shot 2022-06-03 at 8 53 50 PM](https://user-images.githubusercontent.com/221474/171977453-57a21b82-65d0-4a7e-9d93-7235b8cbf95e.png)

**UserPasswordEncoderListener.class**
In the class doesn't work.
![Screen Shot 2022-06-03 at 8 54 03 PM](https://user-images.githubusercontent.com/221474/171977631-6b47f953-a2b0-4d54-8bae-d8c56090d73e.png)

You can check the logs.
![Screen Shot 2022-06-03 at 8 54 11 PM](https://user-images.githubusercontent.com/221474/171977703-41ae2765-90d4-419e-976b-9a44baa79509.png)

Any idea?

### Steps To Reproduce

_No response_

### Environment Information

- Mac OS X
- openjdk version "11.0.14.1" 2022-02-08 LTS
- OpenJDK Runtime Environment Corretto-11.0.14.10.1 (build 11.0.14.1+10-LTS)
- OpenJDK 64-Bit Server VM Corretto-11.0.14.10.1 (build 11.0.14.1+10-LTS, mixed mode)

- MongoDB
- Spring Security Core Plugin

### Example Application

_No response_

### Version

5.1.8

Contributor guide

Open the contributing guide

Research direction

Start with UserPasswordEncoderListener.class and compare its isDirty() or hasChanged() behavior with the User Controller, where the report says the check works. Reproduce the save with Spring Security Core Plugin and MongoDB using the supplied environment details, then verify that an unchanged encoded password is not encoded again.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, mongodb, spring
Domain
authentication, backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.