From f468c13e31dc261c5930a80167427ae7f276f930 Mon Sep 17 00:00:00 2001
From: Alex Chapellon <alexandre.chapellon@alfresco.com>
Date: Mon, 16 Sep 2024 15:37:56 +0200
Subject: [PATCH] OPSEXP-2830: always escape % (also fixes consecutive %)
 (#940)

---
 roles/repository/templates/alfresco-content-unit-overrides.j2 | 2 +-
 roles/search_enterprise/templates/elasticsearch-cfg.j2        | 4 ++--
 .../templates/elasticsearch-connector-reindex.service.j2      | 2 +-
 roles/search_enterprise/vars/main.yml                         | 2 --
 4 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/roles/repository/templates/alfresco-content-unit-overrides.j2 b/roles/repository/templates/alfresco-content-unit-overrides.j2
index 7f885c23c..565222675 100644
--- a/roles/repository/templates/alfresco-content-unit-overrides.j2
+++ b/roles/repository/templates/alfresco-content-unit-overrides.j2
@@ -3,5 +3,5 @@ BindsTo=alfresco-content-monitored-startup.service
 
 [Service]
 {% if repo_keystore | default({}) | dict2items | length > 0 -%}
-Environment="JAVA_OPTS=-Dssl-keystore.password='{{ repo_keystore.pass | default('') }}'"
+Environment="JAVA_OPTS=-Dssl-keystore.password='{{ repo_keystore.pass | default('') | replace('%', '%%') }}'"
 {%- endif %}
diff --git a/roles/search_enterprise/templates/elasticsearch-cfg.j2 b/roles/search_enterprise/templates/elasticsearch-cfg.j2
index b07aabad3..f3cc59432 100644
--- a/roles/search_enterprise/templates/elasticsearch-cfg.j2
+++ b/roles/search_enterprise/templates/elasticsearch-cfg.j2
@@ -3,7 +3,7 @@ Environment=ALFRESCO_ACCEPTED_CONTENT_MEDIA_TYPES_CACHE_BASE_URL=http://{{ trout
 Environment=ELASTICSEARCH_INDEXNAME=alfresco
 Environment=SPRING_ACTIVEMQ_BROKERURL=failover:({{ activemq_transport }}://{{ activemq_host }}:{{ ports_cfg.activemq[activemq_protocol] }})
 Environment=SPRING_ACTIVEMQ_USER={{ activemq_username }}
-Environment=SPRING_ACTIVEMQ_PASSWORD={{ activemq_password | regex_replace(search_enterprise_unit_specifier_regex, '%%\1') }}
+Environment=SPRING_ACTIVEMQ_PASSWORD={{ activemq_password | replace('%', '%%') }}
 Environment=SPRING_ELASTICSEARCH_REST_URIS={{ elasticsearch_protocol }}://{{ elasticsearch_host }}:{{ ports_cfg.elasticsearch.http }}
 Environment=SPRING_ELASTICSEARCH_REST_USERNAME={{ elasticsearch_username }}
-Environment=SPRING_ELASTICSEARCH_REST_PASSWORD={{ elasticsearch_password | regex_replace(search_enterprise_unit_specifier_regex, '%%\1') }}
+Environment=SPRING_ELASTICSEARCH_REST_PASSWORD={{ elasticsearch_password | replace('%', '%%') }}
diff --git a/roles/search_enterprise/templates/elasticsearch-connector-reindex.service.j2 b/roles/search_enterprise/templates/elasticsearch-connector-reindex.service.j2
index 137e217a3..eb03b763e 100644
--- a/roles/search_enterprise/templates/elasticsearch-connector-reindex.service.j2
+++ b/roles/search_enterprise/templates/elasticsearch-connector-reindex.service.j2
@@ -11,7 +11,7 @@ User={{ username }}
 
 Environment=SPRING_DATASOURCE_URL={{ repo_db_url if repo_db_url else 'jdbc:postgresql://' + db_host + ':' + ports_cfg.postgres.sql | string + '/' + repo_db_name }}
 Environment=SPRING_DATASOURCE_USERNAME={{ repo_db_username }}
-Environment=SPRING_DATASOURCE_PASSWORD={{ repo_db_password | regex_replace(search_enterprise_unit_specifier_regex, '%%\1') }}
+Environment=SPRING_DATASOURCE_PASSWORD={{ repo_db_password | replace('%', '%%') }}
 
 ExecStart={{ java_home }}/bin/java -jar {{ search_enterprise_binaries_dir }}/alfresco-elasticsearch-reindexing-{{ search_enterprise.version }}-app.jar {{ search_enterprise_reindex_options }}
 
diff --git a/roles/search_enterprise/vars/main.yml b/roles/search_enterprise/vars/main.yml
index 53605e41f..b2a47562c 100644
--- a/roles/search_enterprise/vars/main.yml
+++ b/roles/search_enterprise/vars/main.yml
@@ -3,5 +3,3 @@
 search_enterprise_binaries_dir: "{{ binaries_folder }}/enterprise-search-{{ search_enterprise.version }}"
 search_enterprise_config_dir: "{{ config_folder }}/enterprise-search"
 search_enterprise_data_dir: "{{ data_folder }}/enterprise-search"
-# System list of uint specifiers https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#Specifiers
-search_enterprise_unit_specifier_regex: '%([aAbBCdDEfgGhHiIjJlLmMnNopPqsStTuUvVwWyY%]|$)'