Major improvements (data-dir, python, locations)

docker/geoserver/Dockerfile

@@ -1,8 +1,7 @@
-ARG IMAGE_VERSION=9.0.106-jdk11-temurin-jammy
-ARG JAVA_HOME=/usr/local/openjdk-11
+ARG IMAGE_VERSION=9.0.118-jdk17-temurin-jammy
 FROM tomcat:$IMAGE_VERSION
 
-ARG GEOSERVER_VERSION=2.27.4
+ARG GEOSERVER_VERSION=2.28.4
 ARG GEOSERVER_CORS_ENABLED=False
 ARG GEOSERVER_CORS_ALLOWED_ORIGINS=*
 ARG GEOSERVER_CORS_ALLOWED_METHODS=GET,POST,PUT,DELETE,HEAD,OPTIONS
@@ -17,41 +16,34 @@ ENV GEOSERVER_CORS_ALLOWED_ORIGINS=$GEOSERVER_CORS_ALLOWED_ORIGINS
 ENV GEOSERVER_CORS_ALLOWED_METHODS=$GEOSERVER_CORS_ALLOWED_METHODS
 ENV GEOSERVER_CORS_ALLOWED_HEADERS=$GEOSERVER_CORS_ALLOWED_HEADERS
 
+RUN apt-get update -y && apt-get -y install --no-install-recommends curl wget unzip procps less gettext-base && rm -rf /var/lib/apt/lists/*
+
 #
 # Download and install GeoServer
 #
-RUN apt-get update -y && apt-get install curl wget unzip -y
 RUN cd /usr/local/tomcat/webapps \
     && wget --no-check-certificate --progress=bar:force:noscroll https://artifacts.geonode.org/geoserver/${GEOSERVER_VERSION}/geoserver.war -O geoserver.war \
     && unzip -q geoserver.war -d geoserver \
     && rm geoserver.war \
     && mkdir -p $GEOSERVER_DATA_DIR
 
-COPY applicationContext.xml /usr/local/tomcat/webapps/geoserver/WEB-INF/classes/applicationContext.xml
-
-VOLUME $GEOSERVER_DATA_DIR
-
-# copy the script and perform the run of scripts from entrypoint.sh
-RUN mkdir -p /usr/local/tomcat/tmp
-WORKDIR /usr/local/tomcat/tmp
-COPY set_geoserver_auth.sh \
-     entrypoint.sh \
-     tasks.py \
-     multidump.sh \
-     multidump-alt.sh \
-     /usr/local/tomcat/tmp/
-
-COPY ./templates /templates
+#
+# Download datadir zip
+# 
+ENV GEOSERVER_SHARE_DIR="/usr/local/share/geoserver"
+RUN mkdir -p $GEOSERVER_SHARE_DIR $GEOSERVER_SHARE_DIR/templates
+RUN wget --no-check-certificate --progress=bar:force:noscroll \
+    https://artifacts.geonode.org/geoserver/$GEOSERVER_VERSION/geonode-geoserver-ext-web-app-data.zip \
+    -O $GEOSERVER_SHARE_DIR/geoserver-data-skeleton.zip
 
-RUN chmod +x \
-        /usr/local/tomcat/tmp/set_geoserver_auth.sh \
-        /usr/local/tomcat/tmp/entrypoint.sh
 
-RUN apt-get install -y procps less && \
-    apt-get install -y python3 python3-pip python3-dev
+COPY ./templates $GEOSERVER_SHARE_DIR/templates
+COPY ./files/applicationContext.xml /usr/local/tomcat/webapps/geoserver/WEB-INF/classes/applicationContext.xml
+COPY ./scripts/ /usr/local/bin/
+RUN chmod +x /usr/local/bin/*.sh
 
-RUN pip install j2cli invoke==2.2.0 requests==2.31.0
+VOLUME $GEOSERVER_DATA_DIR
 
-ENV JAVA_OPTS="-Djava.awt.headless=true -Dgwc.context.suffix=gwc -XX:+UnlockDiagnosticVMOptions -XX:+LogVMOutput -XX:LogFile=/var/log/jvm.log -XX:MaxPermSize=512m -XX:PermSize=256m -Xms512m -Xmx2048m -XX:+UseConcMarkSweepGC -XX:ParallelGCThreads=4 -Dfile.encoding=UTF8 -Djavax.servlet.request.encoding=UTF-8 -Djavax.servlet.response.encoding=UTF-8 -Duser.timezone=GMT -Dorg.geotools.shapefile.datetime=false -DGS-SHAPEFILE-CHARSET=UTF-8 -DGEOSERVER_CSRF_DISABLED=true -DPRINT_BASE_URL=http://geoserver:8080/geoserver/pdf -Xbootclasspath/a:/usr/local/tomcat/webapps/geoserver/WEB-INF/lib/marlin-0.9.3.jar -Dsun.java2d.renderer=org.marlin.pisces.MarlinRenderingEngine"
+ENV JAVA_OPTS="-Djava.awt.headless=true -Dgwc.context.suffix=gwc -XX:+UnlockDiagnosticVMOptions -XX:+LogVMOutput -XX:LogFile=/var/log/jvm.log -Xms2048m -Xmx2048m XX:ParallelGCThreads=4 -Dfile.encoding=UTF8 -Djavax.servlet.request.encoding=UTF-8 -Djavax.servlet.response.encoding=UTF-8 -Duser.timezone=GMT -Dorg.geotools.shapefile.datetime=false -DGS-SHAPEFILE-CHARSET=UTF-8 -DGEOSERVER_CSRF_DISABLED=true -DPRINT_BASE_URL=http://geoserver:8080/geoserver/pdf"
 
-CMD ["/usr/local/tomcat/tmp/entrypoint.sh"]
+CMD ["/usr/local/bin/entrypoint.sh"]

docker/geoserver/README.md

@@ -35,21 +35,6 @@ Point your browser to `http://localhost:8080/geoserver` and login using GeoServe
 * Username: admin
 * Password: geoserver
 
-## How to use different versions
-
-There are mainly two different versions of this image which are useful for running **GeoNode** with different authentication system types. These versions are released as specific tags for two authentication mechanisms:
-
-**Cookie based authn**:
-- [geonode/geoserver:2.9.x](https://hub.docker.com/r/geonode/geoserver/builds/bx7ydhghnlrfnsppduyva73/)
-
-**Oauth2 based authn**:
-- [geonode/geoserver:2.9.x-oauth2](https://hub.docker.com/r/geonode/geoserver/builds/bwca5rtexeoegzgroavftdr/)
-- [geonode/geoserver:2.10.x](https://hub.docker.com/r/geonode/geoserver/builds/bjohcnc29vm69acqjrvndxf/)
-- [geonode/geoserver:2.12.x](https://hub.docker.com/r/geonode/geoserver/builds/bh7pyw5atmkcljurwsnzbs7/)
-- [geonode/geoserver:2.13.x](https://hub.docker.com/r/geonode/geoserver/builds/btmjctbuvrjfnnrxrs4wyrs/)
-- [geonode/geoserver:2.14.x](https://hub.docker.com/r/geonode/geoserver/builds/bj53pi8he8uksz6ggvrs3wc/)
-
-You can declare what version to use along with the data directory tag which corresponds to the same version.  
 
 ## Configuration
 
@@ -64,15 +49,34 @@ You may want to map this volume to a directory on the host. It will also ease th
 -v /your/host/data/path:/geoserver_data/data
 ```
 
-### Data volume container
+#### GeoServer Data Directory Initialization
 
-In case you are running Compose for automatically having GeoServer up and running then a data volume container will be mounted with a default preloaded *GEOSERVER_DATA_DIR* at the configuration data directory of the container.
-Make sure that the image from the repository [data-docker](https://github.com/GeoNode/data-docker) is available from the [GeoNode Docker Hub](https://hub.docker.com/u/geonode/) or has been built locally:
+When running GeoNode via Docker Compose, the core `geoserver` container automatically manages its own persistent configurations. On the very first boot, if the assigned volume is completely empty, an internal initialization step automatically extracts a preconfigured data archive directly into the volume space.
 
-```bash
-docker build -t geonode/geoserver_data .
+This setup contains the default preloaded `GEOSERVER_DATA_DIR` settings (including custom GeoNode extensions, workspaces, and security providers) required for GeoServer to communicate with Django and the database seamlessly.
+
+#### Customizing or Building the Base Data Directory Locally
+If you need to change the base fallback configuration, alter the default zip asset reference built into the core geoserver image:
+
+```Bash
+docker build --build-arg GEOSERVER_VERSION=2.24.x -t geonode/geoserver:latest ./docker/geoserver
 ```
 
+#### Storage and Persistence
+Because the default configurations are extracted dynamically at runtime, your master `docker-compose.yml` must map a named volume or host directory to the target path:
+
+```YAML
+services:
+  geoserver:
+    image: geonode/geoserver:latest
+    environment:
+      - GEOSERVER_DATA_DIR=/geoserver_data/data
+    volumes:
+      - geoserver-data-dir:/geoserver_data/data
+```      
+Subsequent container restarts will detect the existing configuration files (such as global.xml) and safely skip the extraction phase, ensuring all runtime additions, styles, and layer maps are completely preserved.
+
+
 #### Persistance behavior
 
 If you run:
@@ -95,17 +99,6 @@ docker-compose down
 
 Data are completely gone but you can ever start from the base GeoServer Data Directory built for Geonode.
 
-#### Data directory versions
-
-There has to be a correspondence one-to-one between the data directory version and the tag of the GeoServer image used in the Docker compose file. So at the end you can consume these images below:
-
-* **2.9.x**: [geonode/geoserver_data:2.9.x](https://hub.docker.com/r/geonode/geoserver_data/builds/bsus6alnddg4bc7icwymevp/)
-* **2.9.x-oauth2**: [geonode/geoserver_data:2.9.x-oauth2](https://hub.docker.com/r/geonode/geoserver_data/builds/bwkxcupsunvuitzusi9gsnt/)
-* **2.10.x**: [geonode/geoserver_data:2.10.x](https://hub.docker.com/r/geonode/geoserver_data/builds/b5jqhpzapkqxzyevjizccug/)
-* **2.12.x**: [geonode/geoserver_data:2.12.x](https://hub.docker.com/r/geonode/geoserver_data/builds/byaaalw3lnasunpveyg3x4i/)
-* **2.13.x**: [geonode/geoserver_data:2.13.x](https://hub.docker.com/r/geonode/geoserver_data/builds/bunuqzq7a7dk65iumjhkbtc/)
-* **2.14.x**: [geonode/geoserver_data:2.14.x](https://hub.docker.com/r/geonode/geoserver_data/builds/blpdjzkrv7pm3stunzpn4pp/)
-
 ### Database
 
 GeoServer recommends the usage of a spatial database

docker/geoserver/docker-compose.yml

@@ -15,7 +15,7 @@ services:
     restart: on-failure
 
   geoserver:
-    image: geonode/geoserver:2.24.4-latest
+    image: geonode/geoserver:2.28.4-latest
     build:
       context: .
     links:
@@ -29,25 +29,13 @@ services:
     depends_on:
       postgis:
         condition: service_completed_successfully
-      data-dir-conf:
-        condition: service_healthy
     healthcheck:
       test: curl --fail -s http://localhost:8080/geoserver/rest/workspaces/geonode.html || exit 1
       interval: 1m30s
       timeout: 10s
       retries: 3
     restart: on-failure
 
-  data-dir-conf:
-    image: geonode/geoserver_data:2.24.4-latest
-    container_name: geoserver_data_dir # named data container
-    entrypoint: sleep infinity
-    volumes:
-      - /geoserver_data/data
-    healthcheck:
-      test: "ls -A '/geoserver_data/data' | wc -l"
-    restart: on-failure
-
 volumes:
   # reference to the named data container that holds the preloaded geoserver data directory
   geoserver_data_dir:

docker/geoserver/scripts/configure_geoserver.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+echo "************************ Configuring GeoServer credentials *****************************"
+
+# Fallback values identical to the original python task
+GEOSERVER_LB_PORT="${GEOSERVER_LB_PORT:-8080}"
+GEOSERVER_ADMIN_USER="${GEOSERVER_ADMIN_USER:-admin}"
+GEOSERVER_ADMIN_PASSWORD="${GEOSERVER_ADMIN_PASSWORD:-geoserver}"
+GEOSERVER_FACTORY_PASSWORD="${GEOSERVER_FACTORY_PASSWORD:-geoserver}"
+GEOSERVER_DATA_DIR="${GEOSERVER_DATA_DIR:-/geoserver_data/data/}"
+
+REST_URL="http://localhost:${GEOSERVER_LB_PORT}/geoserver/rest/security/self/password"
+
+XML_DATA="<?xml version=\"1.0\" encoding=\"UTF-8\"?><userPassword><newPassword>${GEOSERVER_ADMIN_PASSWORD}</newPassword></userPassword>"
+
+# Retry loop: 1 to 28 attempts, sleeping 2 seconds between each (roughly ~1 minute total timeout)
+for cnt in {1..28}; do
+    echo "...waiting for GeoServer to pop-up... Attempt ${cnt}"
+
+    # Check if GeoServer is responding before attempting PUT
+    if curl -fsS -o /dev/null "http://localhost:${GEOSERVER_LB_PORT}/geoserver/"; then
+        # Execute the password update request using curl basic auth
+        RESPONSE_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X PUT \
+            -u "${GEOSERVER_ADMIN_USER}:${GEOSERVER_FACTORY_PASSWORD}" \
+            -H "Content-Type: application/xml" \
+            -H "Accept: application/xml" \
+            -d "${XML_DATA}" \
+            "${REST_URL}")
+
+        echo "Response Code: ${RESPONSE_CODE}"
+
+        if [ "$RESPONSE_CODE" -eq 200 ]; then
+            echo "GeoServer admin password updated SUCCESSFULLY!"
+            break
+        else
+            echo "WARNING: GeoServer admin password *NOT* updated: code [${RESPONSE_CODE}]"
+        fi
+    fi
+
+    sleep 2
+done
+
+# Initialize the lock file only if configuration succeeded
+if [ "${RESPONSE_CODE:-}" -eq 200 ] 2>/dev/null; then
+    echo "************************** Writing init lockfile ********************************"
+    mkdir -p "${GEOSERVER_DATA_DIR}"
+    date > "${GEOSERVER_DATA_DIR}/geoserver_init.lock"
+else
+    echo "WARNING: GeoServer init lockfile not written because password update did not succeed."
+fi

docker/geoserver/entrypoint.sh → docker/geoserver/scripts/entrypoint.sh

@@ -15,6 +15,28 @@ invoke () {
     echo "$@ tasks done"
 }
 
+
+# create/populate the datadir
+mkdir -p $GEOSERVER_DATA_DIR
+
+if [ ! -f "${GEOSERVER_DATA_DIR}/global.xml" ]; then
+    echo "${GEOSERVER_DATA_DIR}/global.xml not found."
+
+    # needing a tmp extraction because the zip contains /data/ as root    
+    echo "Extracting default data skeleton archive to temp dir..."
+    TMP_EXTRACT="/tmp/geoserver_unzip"
+    mkdir -p "$TMP_EXTRACT"
+    unzip -q "$GEOSERVER_SHARE_DIR/geoserver-data-skeleton.zip" -d "$TMP_EXTRACT"
+    echo "Moving default data skeleton archive directly to volume..."
+#    mv "$TMP_EXTRACT"/data/* "$TMP_EXTRACT"/data/.* "$GEOSERVER_DATA_DIR/" 2>/dev/null || true
+    mv -v "$TMP_EXTRACT"/data/* "$TMP_EXTRACT"/data/.* "$GEOSERVER_DATA_DIR/" || true
+    rm -rf "$TMP_EXTRACT"
+
+    echo "Extraction complete."
+else
+    echo "Existing GeoServer data configuration detected. Skipping extraction."
+fi
+
 # control the values of LB settings if present
 if [ -n "$GEONODE_LB_HOST_IP" ];
 then
@@ -161,51 +183,46 @@ else
     # backup geonodeAuthProvider config.xml
     cp ${GEOSERVER_DATA_DIR}/security/auth/geonodeAuthProvider/config.xml ${GEOSERVER_DATA_DIR}/security/auth/geonodeAuthProvider/config.xml.orig
     # run the setting script for geonodeAuthProvider
-    /usr/local/tomcat/tmp/set_geoserver_auth.sh ${GEOSERVER_DATA_DIR}/security/auth/geonodeAuthProvider/config.xml ${GEOSERVER_DATA_DIR}/security/auth/geonodeAuthProvider/ ${TAGNAME[@]} > /dev/null 2>&1
+    /usr/local/bin/set_geoserver_auth.sh ${GEOSERVER_DATA_DIR}/security/auth/geonodeAuthProvider/config.xml ${GEOSERVER_DATA_DIR}/security/auth/geonodeAuthProvider/ ${TAGNAME[@]} > /dev/null 2>&1
 fi
 
 # backup geonode REST role service config.xml
 cp "${GEOSERVER_DATA_DIR}/security/role/geonode REST role service/config.xml" "${GEOSERVER_DATA_DIR}/security/role/geonode REST role service/config.xml.orig"
 # run the setting script for geonode REST role service
-/usr/local/tomcat/tmp/set_geoserver_auth.sh "${GEOSERVER_DATA_DIR}/security/role/geonode REST role service/config.xml" "${GEOSERVER_DATA_DIR}/security/role/geonode REST role service/" ${TAGNAME[@]} > /dev/null 2>&1
+/usr/local/bin/set_geoserver_auth.sh "${GEOSERVER_DATA_DIR}/security/role/geonode REST role service/config.xml" "${GEOSERVER_DATA_DIR}/security/role/geonode REST role service/" ${TAGNAME[@]} > /dev/null 2>&1
 
 # set oauth2 filter tagname
 TAGNAME=( "cliendId" "clientSecret" "accessTokenUri" "userAuthorizationUri" "redirectUri" "checkTokenEndpointUrl" "logoutUri" )
 
 # backup geonode-oauth2 config.xml
 cp ${GEOSERVER_DATA_DIR}/security/filter/geonode-oauth2/config.xml ${GEOSERVER_DATA_DIR}/security/filter/geonode-oauth2/config.xml.orig
 # run the setting script for geonode-oauth2
-/usr/local/tomcat/tmp/set_geoserver_auth.sh ${GEOSERVER_DATA_DIR}/security/filter/geonode-oauth2/config.xml ${GEOSERVER_DATA_DIR}/security/filter/geonode-oauth2/ "${TAGNAME[@]}" > /dev/null 2>&1
+/usr/local/bin/set_geoserver_auth.sh ${GEOSERVER_DATA_DIR}/security/filter/geonode-oauth2/config.xml ${GEOSERVER_DATA_DIR}/security/filter/geonode-oauth2/ "${TAGNAME[@]}" > /dev/null 2>&1
 
 # set global tagname
 TAGNAME=( "proxyBaseUrl" )
 
 # backup global.xml
 cp ${GEOSERVER_DATA_DIR}/global.xml ${GEOSERVER_DATA_DIR}/global.xml.orig
 # run the setting script for global configuration
-/usr/local/tomcat/tmp/set_geoserver_auth.sh ${GEOSERVER_DATA_DIR}/global.xml ${GEOSERVER_DATA_DIR}/ ${TAGNAME[@]} > /dev/null 2>&1
-
-# set correct amqp broker url
-sed -i -e 's/localhost/rabbitmq/g' ${GEOSERVER_DATA_DIR}/notifier/notifier.xml
+/usr/local/bin/set_geoserver_auth.sh ${GEOSERVER_DATA_DIR}/global.xml ${GEOSERVER_DATA_DIR}/ ${TAGNAME[@]} > /dev/null 2>&1
 
 # exclude wrong dependencies
 sed -i -e 's/xom-\*\.jar/xom-\*\.jar,bcprov\*\.jar/g' /usr/local/tomcat/conf/catalina.properties
 
-# J2 templating for this docker image we should also do it for other configuration files in /usr/local/tomcat/tmp
+# templating for this docker image we should also do it for other configuration files in /usr/local/tomcat/tmp
 
 declare -a geoserver_datadir_template_dirs=("geofence")
 
-for template in in ${geoserver_datadir_template_dirs[*]}; do
-    #Geofence templates
+for template in ${geoserver_datadir_template_dirs[*]}; do
     if [ "$template" == "geofence" ]; then
-      cp -R /templates/$template/* ${GEOSERVER_DATA_DIR}/geofence
-
-      for f in $(find ${GEOSERVER_DATA_DIR}/geofence/ -type f -name "*.j2"); do
-          echo -e "Evaluating template\n\tSource: $f\n\tDest: ${f%.j2}"
-          /usr/local/bin/j2 $f > ${f%.j2}
-          rm -f $f
-      done
+        cp -vR $GEOSERVER_SHARE_DIR/templates/$template/* ${GEOSERVER_DATA_DIR}/geofence
 
+        for f in $(find ${GEOSERVER_DATA_DIR}/geofence/ -type f -name "*.envsubst"); do
+            echo -e "Evaluating template\n\tSource: $f\n\tDest: ${f%.envsubst}"
+            envsubst < "$f" > "${f%.envsubst}"        
+            rm -vf "$f"
+        done
     fi
 done
 
@@ -240,10 +257,10 @@ if [ "${GEOSERVER_CORS_ENABLED}" = "true" ] || [ "${GEOSERVER_CORS_ENABLED}" = "
   fi
 fi
 
-if [ ${FORCE_REINIT} = "true" ]  || [ ${FORCE_REINIT} = "True" ] || [ ! -e "${GEOSERVER_DATA_DIR}/geoserver_init.lock" ]; then
-    # Run async configuration, it needs Geoserver to be up and running
-    # executes step configure-geoserver from task.py file
-    nohup sh -c "invoke configure-geoserver" &
+
+if [ "${FORCE_REINIT}" = "true" ] || [ "${FORCE_REINIT}" = "True" ] || [ ! -e "${GEOSERVER_DATA_DIR}/geoserver_init.lock" ]; then
+    # Run async configuration, it needs GeoServer to be up and running
+    nohup /usr/local/bin/configure_geoserver.sh &
 fi
 
 # start tomcat

docker/geoserver/set_geoserver_auth.sh → docker/geoserver/scripts/set_geoserver_auth.sh

@@ -42,6 +42,16 @@ done
 
 echo "DEBUG: Starting... [Ok]\n"
 
+# Escape a string for safe use in sed's REGEX (pattern) side, given @ delimiter
+escape_regex() {
+    printf '%s' "$1" | sed -e 's/[][\\.^$*+?(){}|@/-]/\\&/g'
+}
+
+# Escape a string for safe use in sed's REPLACEMENT side, given @ delimiter
+escape_replacement() {
+    printf '%s' "$1" | sed -e 's/[\\&@/]/\\&/g'
+}
+
 for i in "${tagname[@]}"
 do
     echo "DEBUG: Working on '$auth_conf_source' for tagname <$i>"
@@ -54,27 +64,24 @@ do
     # Setting new substituted value
     case $i in
         authApiKey)
-            echo "DEBUG: Editing '$auth_conf_source' for tagname <$i> and replacing its value with '$OAUTH2_API_KEY'"
-            newvalue=`echo -ne "$tagvalue" | sed -re "s@.*@$OAUTH2_API_KEY@"`;;
+            newvalue="$OAUTH2_API_KEY";;
         cliendId)
-            echo "DEBUG: Editing '$auth_conf_source' for tagname <$i> and replacing its value with '$OAUTH2_CLIENT_ID'"
-            newvalue=`echo -ne "$tagvalue" | sed -re "s@.*@$OAUTH2_CLIENT_ID@"`;;
+            newvalue="$OAUTH2_CLIENT_ID";;
         clientSecret)
-            echo "DEBUG: Editing '$auth_conf_source' for tagname <$i> and replacing its value with '$OAUTH2_CLIENT_SECRET'"
-            newvalue=`echo -ne "$tagvalue" | sed -re "s@.*@$OAUTH2_CLIENT_SECRET@"`;;
+            newvalue="$OAUTH2_CLIENT_SECRET";;
         proxyBaseUrl | redirectUri | userAuthorizationUri | logoutUri )
-            echo "DEBUG: Editing '$auth_conf_source' for tagname <$i> and replacing its value with '$GEOSERVER_LOCATION'"
-            newvalue=`echo -ne "$tagvalue" | sed -re "s@^(https?://[^/]+)@${GEOSERVER_LOCATION%/}@"`;;
+            newvalue=`printf '%s' "$tagvalue" | sed -re "s@^(https?://[^/]+)@${GEOSERVER_LOCATION%/}@"`;;
         baseUrl | accessTokenUri | checkTokenEndpointUrl )
-            echo "DEBUG: Editing '$auth_conf_source' for tagname <$i> and replacing its value with '$GEONODE_LOCATION'"
-            newvalue=`echo -ne "$tagvalue" | sed -re "s@^(https?://[^/]+)@${GEONODE_LOCATION%/}@"`;;
-        *) echo -n "an unknown variable has been found";;
+            newvalue=`printf '%s' "$tagvalue" | sed -re "s@^(https?://[^/]+)@${GEONODE_LOCATION%/}@"`;;
+        *) echo "an unknown variable has been found"; continue;;
     esac
 
     echo "DEBUG: Found the new value for the element <$i> - '$newvalue'"
-    # Replacing element’s value with $SUBSTITUTION_URL
-    # echo -ne "<$i>$tagvalue</$i>" | xmlstarlet sel -t -m "//a" -v . -n
-    sed -e "s@<$i>$tagvalue<\/$i>@<$i>$newvalue<\/$i>@g" "$auth_conf_source" > "$temp_file"
+
+    # Match the whole element (empty or not); only the tag name is interpolated,
+    # so the user-controlled content goes through the escapers.
+    new_esc=`escape_replacement "$newvalue"`
+    sed -E "s@(<$i>)[^<]*(</$i>)@\1${new_esc}\2@g" "$auth_conf_source" > "$temp_file"
     cp "$temp_file" "$auth_conf_source"
 done
 # Writing our changes back to the original file ($auth_conf_source)