From 0d6066e0b64cd94a21acbf1760dd4c86fbd3c04b Mon Sep 17 00:00:00 2001 From: Nitesh Yadav Date: Thu, 1 Oct 2026 12:13:02 +0530 Subject: [PATCH] fix(useradmin): strip password placeholder from a pending-edit replay payload A pending user edit's stored payload keeps a "[PROTECTED]" placeholder for the password rather than the real value. The actual new password is applied separately via request.getPasswordHash(), so the placeholder must not reach AppUser.update() or it tries to re-encode the literal placeholder string. Co-Authored-By: Claude Sonnet 5 --- .../service/UserPendingWritePlatformServiceImpl.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java index 3806b6b24..16d140cb1 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java @@ -321,6 +321,14 @@ public class UserPendingWritePlatformServiceImpl implements UserPendingWritePlat .orElseThrow(() -> new UserNotFoundException(request.getUserId())); final JsonElement parsedElement = this.fromApiJsonHelper.parse(request.getPayloadJson()); + if (parsedElement.isJsonObject()) { + // the stored payload keeps a "[PROTECTED]" placeholder for the password rather than + // the real value; the actual new password is applied below via request.getPasswordHash(), + // so these keys must not reach AppUser.update() or it will try to re-encode the placeholder + final JsonObject payloadObject = parsedElement.getAsJsonObject(); + payloadObject.remove("password"); + payloadObject.remove("repeatPassword"); + } final JsonCommand replay = JsonCommand.fromJsonElement(request.getUserId(), parsedElement, this.fromApiJsonHelper); final Map changes = userToUpdate.update(replay, null, null);