Safer defaults

[snoopdave]

Description: This pull request introduces several changes aimed at improving the security and configuration defaults of the Apache Roller project. The key changes include:

Salt Handling Enhancements:

• Modified LoadSaltFilter to associate salts with user IDs.
• Updated ValidateSaltFilter to validate salts against user IDs, enhancing security.

Configuration Defaults:

• Disabled file uploads by default.
• Disabled custom themes by default.
• Enabled HTML sanitization for all users by default.

Test Improvements:

• Added configuration to enable media uploads during tests in MediaFileTest.

Documentation Updates:

• Updated the installation guide to reflect the new security defaults.
• Updated the template guide to inform users about the new default settings for custom themes.

[mbien]

@snoopdave I didn't have time to look into this yet, but it looks like the tests don't like this change. I try to take a look this weekend.

[mbien]

@snoopdave this one property is all what is needed to make the tests happy again:

diff --git a/app/src/test/java/org/apache/roller/weblogger/business/MediaFileTest.java b/app/src/test/java/org/apache/roller/weblogger/business/MediaFileTest.java
index 828735c..7e89295 100644
--- a/app/src/test/java/org/apache/roller/weblogger/business/MediaFileTest.java
+++ b/app/src/test/java/org/apache/roller/weblogger/business/MediaFileTest.java
@@ -51,6 +51,9 @@
     @BeforeEach
     public void setUp() throws Exception {
         TestUtils.setupWeblogger();
+        // allow media uploads for this test
+        Map<String, RuntimeConfigProperty> config = WebloggerFactory.getWeblogger().getPropertiesManager().getProperties();
+        config.get("uploads.enabled").setValue("true");
     }
 
     /**

a failing MediaFileTest can influence other tests since some of the tear down is in the test cases - so it looked a bit worse at first.

[snoopdave]

I also made some changes with SaltCache so that we can associated salt's with authenticated users. I'll do some more testing this weekend.

[mbien]

makes sense to me