@@ -, +, @@
---
Koha/AuthUtils.pm | 48 ++++++++++++++++++
.../prog/en/modules/members/member-password.tt | 12 +++--
.../prog/en/modules/members/memberentrygen.tt | 19 ++++++--
.../bootstrap/en/modules/opac-memberentry.tt | 11 ++++-
.../opac-tmpl/bootstrap/en/modules/opac-passwd.tt | 16 +++---
.../bootstrap/en/modules/opac-password-recovery.tt | 11 +++--
members/member-password.pl | 14 ++++--
members/memberentry.pl | 15 ++++--
opac/opac-memberentry.pl | 18 ++++---
opac/opac-passwd.pl | 57 +++++++++++-----------
opac/opac-password-recovery.pl | 57 ++++++++++------------
t/AuthUtils.t | 49 ++++++++++++++++++-
12 files changed, 230 insertions(+), 97 deletions(-)
--- a/Koha/AuthUtils.pm
+++ a/Koha/AuthUtils.pm
@@ -22,6 +22,9 @@ use Crypt::Eksblowfish::Bcrypt qw(bcrypt en_base64);
use Encode qw( encode is_utf8 );
use Fcntl qw/O_RDONLY/; # O_RDONLY is used in generate_salt
use List::MoreUtils qw/ any /;
+use String::Random qw( random_string );
+
+use C4::Context;
use base 'Exporter';
@@ -134,6 +137,51 @@ sub generate_salt {
return $string;
}
+=head2 is_password_valid
+
+my ( $is_valid, $error ) = is_password_valid( $password );
+
+return $is_valid == 1 if the password match minPasswordLength and RequireStrongPassword conditions
+otherwise return $is_valid == 0 and $error will contain the error ('too_short' or 'too_weak')
+
+=cut
+
+sub is_password_valid {
+ my ($password) = @_;
+ my $minPasswordLength = C4::Context->preference('minPasswordLength');
+ $minPasswordLength = 3 if not $minPasswordLength or $minPasswordLength < 3;
+ if ( length($password) < $minPasswordLength ) {
+ return ( 0, 'too_short' );
+ }
+ elsif ( C4::Context->preference('RequireStrongPassword') ) {
+ return ( 0, 'too_weak' )
+ if $password !~ m|(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{$minPasswordLength,}|;
+ }
+ return ( 0, 'has_whitespaces' ) if $password =~ m[^\s|\s$];
+ return ( 1, undef );
+}
+
+=head2 generate_password
+
+my password = generate_password();
+
+Generate a password according to the minPasswordLength and RequireStrongPassword.
+
+=cut
+
+sub generate_password {
+ my $minPasswordLength = C4::Context->preference('minPasswordLength');
+ $minPasswordLength = 8 if not $minPasswordLength or $minPasswordLength < 8;
+
+ my ( $password, $is_valid );
+ do {
+ $password = random_string('.' x $minPasswordLength );
+ ( $is_valid, undef ) = is_password_valid( $password );
+ } while not $is_valid;
+ return $password;
+}
+
+
=head2 get_script_name
This returns the correct script name, for use in redirecting back to the correct page after showing
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
+++ a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
@@ -93,9 +93,15 @@
[% IF ( BADUSERID ) %]
You have entered a username that already exists. Please choose another one.
[% END %]
- [% IF ( SHORTPASSWORD ) %]
- The password entered is too short. Password must be at least [% minPasswordLength %] characters.
- [% END %]
+ [% IF ( ERROR_password_too_short ) %]
+ Password must be at least [% minPasswordLength %] characters long.
+ [% END %]
+ [% IF ( ERROR_password_too_weak ) %]
+ Password must contain at least one digit, one lowercase and one uppercase.
+ [% END %]
+ [% IF ( ERROR_password_has_whitespaces ) %]
+ Password must not contain leading or trailing whitespaces.
+ [% END %]
[% IF ( NOPERMISSION ) %]
You do not have permission to edit this patron's login information.
[% END %]
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -196,9 +196,15 @@ $(document).ready(function() {
[% IF ( ERROR_dateexpiry ) %]
Date of expiration is invalid.
[% END %]
- [% IF ( ERROR_short_password ) %]
- Password must be at least [% minPasswordLength %] characters long.
- [% END %]
+ [% IF ( ERROR_password_too_short ) %]
+ Password must be at least [% minPasswordLength %] characters long.
+ [% END %]
+ [% IF ( ERROR_password_too_weak ) %]
+ Password must contain at least one digit, one lowercase and one uppercase.
+ [% END %]
+ [% IF ( ERROR_password_has_whitespaces ) %]
+ Password must not contain leading or trailing whitespaces.
+ [% END %]
[% IF ( ERROR_password_mismatch ) %]
Passwords do not match.
[% END %]
@@ -910,8 +916,11 @@ $(document).ready(function() {
[% END %]
[% END %]
[% END %]
- [% IF ( mandatorypassword ) %]Required[% END %][% IF ( ERROR_short_password ) %]Password is too short[% END %]
- Minimum password length: [% minPasswordLength %]
+ [% IF ( mandatorypassword ) %]Required[% END %]
+ [% IF ( ERROR_password_too_short ) %]Password is too short[% END %]
+ [% IF ( ERROR_password_too_weak ) %]Password is too weak[% END %]
+ [% IF ( ERROR_password_has_whitespaces ) %]Password has leading or trailing whitespaces[% END %]
+ Minimum password length: [% minPasswordLength %]
[% IF ( mandatorypassword ) %]
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
+++ a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
@@ -65,8 +65,15 @@
[% IF field == "emailpro" %]Contact information: secondary email address[% END %]
[% IF field == "B_email" %]Alternate address information: email address[% END %]
[% IF field == "password_match" %]Passwords do not match! password[% END %]
- [% IF field == "password_invalid" %]Password does not meet minimum requirements! password[% END %]
- [% IF field == "password_spaces" %]Password contains leading and/or trailing spaces! password[% END %]
+ [% IF field == "password_too_short" %]
+ Password must be at least [% minPasswordLength %] characters long.
+ [% END %]
+ [% IF field == "password_too_weak" %]
+ Password must contain at least one digit, one lowercase and one uppercase.
+ [% END %]
+ [% IF field == "password_has_whitespaces" %]
+ Password must not contain leading or trailing whitespaces.
+ [% END %]
[% IF field == "duplicate_email" %]
This email address already exists in our database.
[% END %]
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
+++ a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
@@ -29,18 +29,22 @@
There was a problem with your submission
- [% IF ( PassMismatch ) %]
+ [% IF ( passwords_mismatch ) %]
Passwords do not match. Please re-type your new password.
[% END %]
- [% IF ( ShortPass ) %]
- Your new password must be at least [% minPasswordLength%] characters long.
+ [% IF password_too_short %]
+ Password must be at least [% minPasswordLength %] characters long.
[% END %]
+ [% IF password_too_weak %]
+ Password must contain at least one digit, one lowercase and one uppercase.
+ [% END %]
+ [% IF password_has_whitespaces %]
+ Password must not contain leading or trailing whitespaces.
+ [% END %]
+
[% IF ( WrongPass ) %]
Your current password was entered incorrectly. If this problem persists, please ask a librarian to reset your password for you.
[% END %]
- [% IF PasswordContainsTrailingSpaces %]
- Your password contains leading and/or trailing spaces.
- [% END %]
[% END # /IF Error_messages %]
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
+++ a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
@@ -63,9 +63,12 @@
If you did not receive this email, you can request a new one: Get new password recovery link
[% ELSIF (errPassNotMatch) %]
The passwords do not match.
- [% ELSIF (errPassTooShort) %]
- Your chosen password is too short.
-
The password must contain at least [% minPassLength %] characters.
+ [% ELSIF password_too_short %]
+ Password must be at least [% minPasswordLength %] characters long.
+ [% ELSIF password_too_weak %]
+ Password must contain at least one digit, one lowercase and one uppercase.
+ [% ELSIF password_has_whitespaces %]
+ Password must not contain leading or trailing whitespaces.
[% ELSIF (errLinkNotValid) %]
The link you clicked is either invalid, or expired.
Be sure you used the link from the email, or contact library staff for assistance.
@@ -95,7 +98,7 @@