Add password strength plugin using complexify. This should be linked to system preferences, and apply to both staff and public logins.
Created attachment 38855 [details] [review] Add jquery-complexify library
Created attachment 38856 [details] [review] Added complexify display to opac-passwd page
Created attachment 38857 [details] [review] Change formatting and correct spelling mistakes
Created attachment 38858 [details] [review] Add OPACPasswordStrength syspref to staff client
Created attachment 38859 [details] [review] Add SQL for OPACPasswordStrength syspref
Created attachment 38860 [details] [review] Add default OPACPasswordStrength syspref to updatedatabase.pl
Created attachment 38861 [details] [review] Add OPACPasswordStrength System Preference to Auth.pm
Created attachment 38862 [details] [review] Put password meter under syspref control
Created attachment 38863 [details] [review] Add password strength meter to staff client
Created attachment 38864 [details] [review] Add jquery plugins to staff client
Created attachment 38865 [details] [review] Add complexify includes file to staff client
Created attachment 38866 [details] [review] Add new PasswordStrength syspref
Created attachment 38867 [details] [review] Add code to updatedatabase.pl
Created attachment 38868 [details] [review] Put staff client password strength meter under syspref control
Created attachment 38869 [details] [review] Add password strength meter to add and duplicate user in staff client
To Test: This patch adds two new system preferences: PasswordStrength which works in the staff client, and OPACPasswordStrength which controls the OPAC. 1) Install patches 2) Enable both system preferences. 3) Log into the OPAC 4) Go to "Change your Password" 5) Type a new password into the new password field - the meter should indicate how strong the password is based on the length of the password and whether or not any part of the password appears in a ban list of some 500 bad passwords (e.g. qwerty, password, 1234 etc) 6) Log into the staff client 7) Create a new patron - the meter should display next to the password field. 8) Check that it also displays when editing or duplicating a patron. Check that typing into the field moves the meter appropriately, and that you are still able to save passwords / edits to the user record when this system preference is enabled.
Created attachment 39322 [details] [review] Add password strength meter to add and duplicate user in staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: tadeasm <tadeas.moravec@gmail.com> Works as expected
Created attachment 39323 [details] [review] Add jquery-complexify library http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39324 [details] [review] Added complexify display to opac-passwd page http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39325 [details] [review] Change formatting and correct spelling mistakes http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39326 [details] [review] Add OPACPasswordStrength syspref to staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39327 [details] [review] Add SQL for OPACPasswordStrength syspref http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39328 [details] [review] Add default OPACPasswordStrength syspref to updatedatabase.pl http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39329 [details] [review] Add OPACPasswordStrength System Preference to Auth.pm http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39330 [details] [review] Put password meter under syspref control http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39331 [details] [review] Add password strength meter to staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39332 [details] [review] Add jquery plugins to staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39333 [details] [review] Add complexify includes file to staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39334 [details] [review] Add new PasswordStrength syspref http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39335 [details] [review] Add code to updatedatabase.pl http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39336 [details] [review] Put staff client password strength meter under syspref control http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39337 [details] [review] Add password strength meter to add and duplicate user in staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: tadeasm <tadeas.moravec@gmail.com> Works as expected Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
I don't see the strength indicator on members/member-password.pl Can you please add it there as well?
Created attachment 39544 [details] [review] Add password strength to member-password screen
Good spot - I've now added it to that screen. Changing status back to needing sign-off. Test plan remains the same, but including the Change Password feature in the staff client.
Created attachment 39547 [details] [review] Add jquery-complexify library http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39548 [details] [review] Added complexify display to opac-passwd page http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39549 [details] [review] Change formatting and correct spelling mistakes http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39550 [details] [review] Add OPACPasswordStrength syspref to staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39551 [details] [review] Add SQL for OPACPasswordStrength syspref http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39552 [details] [review] Add default OPACPasswordStrength syspref to updatedatabase.pl http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39553 [details] [review] Add OPACPasswordStrength System Preference to Auth.pm http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39554 [details] [review] Put password meter under syspref control http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39555 [details] [review] Add password strength meter to staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39556 [details] [review] Add jquery plugins to staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39557 [details] [review] Add complexify includes file to staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39558 [details] [review] Add new PasswordStrength syspref http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39559 [details] [review] Add code to updatedatabase.pl http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39560 [details] [review] Put staff client password strength meter under syspref control http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39561 [details] [review] Add password strength meter to add and duplicate user in staff client http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: tadeasm <tadeas.moravec@gmail.com> Works as expected Signed-off-by: Tadeasm <tadeas.moravec@gmail.com> Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Created attachment 39562 [details] [review] Add password strength to member-password screen http://bugs.koha-community.org/show_bug.cgi?id=13664 Signed-off-by: Tadeasm <tadeas.moravec@gmail.com>
Applying: Put staff client password strength meter under syspref control fatal: sha1 information is lacking or useless (C4/Auth.pm). Repository lacks necessary blobs to fall back on 3-way merge. Cannot fall back to three-way merge.
Created attachment 39594 [details] [review] Add jquery-complexify library
Created attachment 39595 [details] [review] Added complexify display to opac-passwd page
Created attachment 39596 [details] [review] Change formatting and correct spelling mistakes
Created attachment 39597 [details] [review] Add OPACPasswordStrength syspref to staff client
Created attachment 39598 [details] [review] Add SQL for OPACPasswordStrength syspref
Created attachment 39599 [details] [review] Add default OPACPasswordStrength syspref to updatedatabase.pl
Created attachment 39600 [details] [review] Add OPACPasswordStrength System Preference to Auth.pm
Created attachment 39601 [details] [review] Put password meter under syspref control
Created attachment 39602 [details] [review] Add password strength meter to staff client
Created attachment 39603 [details] [review] Add jquery plugins to staff client
Created attachment 39604 [details] [review] Add complexify includes file to staff client
Created attachment 39605 [details] [review] Add new PasswordStrength syspref
Created attachment 39606 [details] [review] Add code to updatedatabase.pl
Created attachment 39607 [details] [review] Put staff client password strength meter under syspref control
Created attachment 39608 [details] [review] Add password strength meter to add and duplicate user in staff client
Created attachment 39609 [details] [review] Add password strength to member-password screen
I've resubmitted the patch, and it seems to apply OK for me now.
You can switch the status back to Signed Off after a rebase, unless you are not confident and/or you rewrote a part of the patches to fix the conflict.
Ah, I didn't know that. All the patches have been signed off, so I'll change the status. Thanks
QA comment: 1/ Really, it's very hard to provide a strong password with this plugin... Something like "A1!p2@3foo4bar%" only fill half of the gauge. 2/ There is no indication to explain what is the gauge 3/ New lib has to be added to the about page. 4/ FAIL installer/data/mysql/updatedatabase.pl FAIL forbidden patterns forbidden pattern: Use INSERT IGNORE INTO on inserting a new syspref (see bug 9071) (line 10532) forbidden pattern: Use INSERT IGNORE INTO on inserting a new syspref (see bug 9071) (line 10526) 5/ No need to pass the pref value in C4::Auth, use the Koha TT plugin 6/ [% INCLUDE 'complexify.inc' %] should be put in the head part 7/ in members/member-password.tt you include the complexity.inc but also include the jquery.complexify.js from github 8/ The most important: the gauges are not the same at the OPAC and at the intranet. Marked as Failed QA.
Ha yes, something else: 16 patches is much too many for this features :)
There already is an implementation for this feature. Bug 12617 I recommend you avoid adding new sysprefs and use borrower category parameters instead. There are way too many sysprefs already. Think on how to remove excess, not add new ones. See Bug 12617. The way the patches are split to separate pieces is pretty cool. This would be a great tutorial on how to write code for Koha! I believe the RM can squash these together when pushing to master. Personally I cannot find enough integrity to keep the code commits in such small and condensed chunks. Should be small enough steps for the community small-steps-guideline.
(In reply to Olli-Antti Kivilahti from comment #74) Most of the code from this bug report will be replaced with patches from bug 18298.
*** This bug has been marked as a duplicate of bug 18292 ***
(In reply to Martin Renvoize (ashimema) from comment #76) > > *** This bug has been marked as a duplicate of bug 18292 *** I guess you meant bug 18298. *** This bug has been marked as a duplicate of bug 18298 ***