Attachment #109524 for bug #23816

View | Details | Raw Unified | Return to bug 23816
Collapse All | Expand All





=head2 is_password_valid

my ( $is_valid, $error ) = is_password_valid( $password, $category );

return $is_valid == 1 if the password match category's minimum password length and strength if provided, or general minPasswordLength and RequireStrongPassword conditions
otherwise return $is_valid == 0 and $error will contain the error ('too_short' or 'too_weak')

=cut

sub is_password_valid {
    my ($password, $category) = @_;
    my $minPasswordLength = $category?$category->effective_min_password_length:C4::Context->preference('minPasswordLength');
    $minPasswordLength = 3 if not $minPasswordLength or $minPasswordLength < 3;
    if ( length($password) < $minPasswordLength ) {
        return ( 0, 'too_short' );
    }
    elsif ( $category?$category->effective_require_strong_password:C4::Context->preference('RequireStrongPassword') ) {
        return ( 0, 'too_weak' )
          if $password !~ m|(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{$minPasswordLength,}|;
    }


=head2 generate_password

my password = generate_password($category);

Generate a password according to category's minimum password length and strength if provided, or to the minPasswordLength and RequireStrongPassword system preferences.

=cut

sub generate_password {
    my ($category) = @_;
    my $minPasswordLength = $category?$category->effective_min_password_length:C4::Context->preference('minPasswordLength');
    $minPasswordLength = 8 if not $minPasswordLength or $minPasswordLength < 8;

    my ( $password, $is_valid );
    do {
        $password = random_string('.' x $minPasswordLength );
        ( $is_valid, undef ) = is_password_valid( $password, $category );
    } while not $is_valid;
    return $password;
}

Lines 744-754 sub set_password { Link Here

(-)a/Koha/Patron.pm (-2 / +2 lines)
744	my $password = $args->{password};	744	my $password = $args->{password};
745		745
746	unless ( $args->{skip_validation} ) {	746	unless ( $args->{skip_validation} ) {
747	my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $password );	747	my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $password, $self->category );
748		748
749	if ( !$is_valid ) {	749	if ( !$is_valid ) {
750	if ( $error eq 'too_short' ) {	750	if ( $error eq 'too_short' ) {
751	my $min_length = C4::Context->preference('minPasswordLength');	751	my $min_length = $self->category->effective_min_password_length;
752	$min_length = 3 if not $min_length or $min_length < 3;	752	$min_length = 3 if not $min_length or $min_length < 3;
753		753
754	my $password_length = length($password);	754	my $password_length = length($password);




        : C4::Context->preference('OpacPasswordChange');
}

=head3 effective_min_password_length

    $category->effective_min_password_length()

Retrieve category's password length if setted, or minPasswordLength otherwise

=cut

sub effective_min_password_length {
    my ($self) = @_;

    return C4::Context->preference('minPasswordLength') unless defined $self->min_password_length;

    return $self->min_password_length;
}

=head3 effective_require_strong_password

    $category->effective_require_strong_password()

Retrieve category's password strength if setted, or RequireStrongPassword otherwise

=cut

sub effective_require_strong_password {
    my ($self) = @_;

    return C4::Context->preference('RequireStrongPassword') unless defined $self->require_strong_password;

    return $self->require_strong_password;
}

=head3 override_hidden_items

    if ( $patron->category->override_hidden_items ) {

Lines 95-104 elsif ( $op eq 'add_validate' ) { Link Here

(-)a/admin/categories.pl (+8 lines)
95	my $reset_password = $input->param('reset_password');	95	my $reset_password = $input->param('reset_password');
96	my $change_password = $input->param('change_password');	96	my $change_password = $input->param('change_password');
97	my $exclude_from_local_holds_priority = $input->param('exclude_from_local_holds_priority');	97	my $exclude_from_local_holds_priority = $input->param('exclude_from_local_holds_priority');
		98	my $min_password_length = $input->param('min_password_length');
		99	my $require_strong_password = $input->param('require_strong_password');
98	my @branches = grep { $_ ne q{} } $input->multi_param('branches');	100	my @branches = grep { $_ ne q{} } $input->multi_param('branches');
99		101
100	$reset_password = undef if $reset_password eq -1;	102	$reset_password = undef if $reset_password eq -1;
101	$change_password = undef if $change_password eq -1;	103	$change_password = undef if $change_password eq -1;
		104	$min_password_length = undef unless length($min_password_length);
		105	$require_strong_password = undef if $require_strong_password eq -1;
102		106
103	my $is_a_modif = $input->param("is_a_modif");	107	my $is_a_modif = $input->param("is_a_modif");
104		108
Lines 131-136 elsif ( $op eq 'add_validate' ) { Link Here
131	$category->reset_password($reset_password);	135	$category->reset_password($reset_password);
132	$category->change_password($change_password);	136	$category->change_password($change_password);
133	$category->exclude_from_local_holds_priority($exclude_from_local_holds_priority);	137	$category->exclude_from_local_holds_priority($exclude_from_local_holds_priority);
		138	$category->min_password_length($min_password_length);
		139	$category->require_strong_password($require_strong_password);
134	eval {	140	eval {
135	$category->store;	141	$category->store;
136	$category->replace_branch_limitations( \@branches );	142	$category->replace_branch_limitations( \@branches );
Lines 160-165 elsif ( $op eq 'add_validate' ) { Link Here
160	reset_password => $reset_password,	166	reset_password => $reset_password,
161	change_password => $change_password,	167	change_password => $change_password,
162	exclude_from_local_holds_priority => $exclude_from_local_holds_priority,	168	exclude_from_local_holds_priority => $exclude_from_local_holds_priority,
		169	min_password_length => $min_password_length,
		170	require_strong_password => $require_strong_password,
163	});	171	});
164	eval {	172	eval {
165	$category->store;	173	$category->store;




[% USE Koha %]
[% BLOCK add_password_check %]
<!-- password_check.inc -->
<script>
    var pwd_title = "";
    var pattern_title = "";
    var new_password_node_name = "[% new_password | html %]";
    var category_selector = "[% category_selector | html %]";
    var STRONG_MSG = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers");
    var WEAK_MSG = _("Password must contain at least %s characters");

    if(category_selector && $('select'+category_selector).length) {
        jQuery.validator.addMethod("password_strong", function(value, element){
            var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong');
            var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength');
            var regex_text = require_strong?"(?=.*\\d)(?=.*[a-z])(?=.*[A-Z]).{"+min_lenght+",}":".{"+min_lenght+",}";
            var pattern_regex = new RegExp(regex_text);
            return this.optional(element) || pattern_regex.test(value);
        }, function(unused, element) {
            var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong');
            var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength');
            return (require_strong?STRONG_MSG:WEAK_MSG).format(min_lenght)
        });
    } else {
        [% IF RequireStrongPassword %]
            pwd_title = STRONG_MSG.format([% minPasswordLength | html %]);
            pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% minPasswordLength | html %],}/;
        [% ELSIF minPasswordLength %]
            pwd_title = WEAK_MSG.format([% minPasswordLength | html %]);
            pattern_regex = /.{[% minPasswordLength | html %],}/;
        [% END %]
        jQuery.validator.addMethod("password_strong", function(value, element){
            return this.optional(element) || value == '****' || pattern_regex.test(value);
        }, pwd_title);
    }
    jQuery.validator.addMethod("password_no_spaces", function(value, element){
        return ( this.optional(element) || !value.match(/^\s/) && !value.match(/\s$/) );
    }, _("Password contains leading and/or trailing spaces"));

    }, _("Please enter the same password as above"));
</script>
<!-- / password_check.inc -->
[% END %]




                      [% END %]
                    </select>
                </li>
                <li>
                    <label for="min_password_length">Minimum password length:</label>
                    <input id="min_password_length" type="number" name="min_password_length" value="[% category.min_password_length | html %]"/>
                    <span>Leave blank to use system default ([% Koha.Preference('minPasswordLength') | html %])</span>
                </li>
                <li class="pwd_setting_wrapper">
                    <label for="require_strong_password">Require strong password:</label>
                    <select id="require_strong_password" name="require_strong_password">
                    [% IF category.require_strong_password.defined %]
                        [% IF category.require_strong_password %]
                          [% IF Koha.Preference('RequireStrongPassword') %]
                            <option value="-1">Follow system preference RequireStrongPassword (yes)</option>
                          [% ELSE %]
                            <option value="-1">Follow system preference RequireStrongPassword (no)</option>
                          [% END %]
                            <option value="1" selected="selected">Yes</option>
                            <option value="0">No</option>
                        [% ELSE %]
                          [% IF Koha.Preference('RequireStrongPassword') %]
                            <option value="-1">Follow system preference RequireStrongPassword (yes)</option>
                          [% ELSE %]
                            <option value="-1">Follow system preference RequireStrongPassword (no)</option>
                          [% END %]
                            <option value="1">Yes</option>
                            <option value="0" selected="selected">No</option>
                        [% END %]
                      [% ELSE %]
                          [% IF Koha.Preference('RequireStrongPassword') %]
                            <option value="-1">Follow system preference RequireStrongPassword (yes)</option>
                          [% ELSE %]
                            <option value="-1">Follow system preference RequireStrongPassword (no)</option>
                          [% END %]
                            <option value="1">Yes</option>
                            <option value="0">No</option>
                      [% END %]
                    </select>
                </li>
                <li><label for="block_expired">Block expired patrons:</label>
                    <select name="BlockExpiredPatronOpacActions" id="block_expired">
                        [% IF not category or category.BlockExpiredPatronOpacActions == -1%]




        <li>You have entered a username that already exists. Please choose another one.</li>
		[% END %]
        [% IF ( ERROR_password_too_short ) %]
            <li id="ERROR_short_password">Password must be at least [% patron.category.effective_min_password_length | html %] characters long.</li>
        [% END %]
        [% IF ( ERROR_password_too_weak ) %]
            <li id="ERROR_weak_password">Password must contain at least one digit, one lowercase and one uppercase.</li>

	<ol>
    <li><label for="newuserid">New username:</label>
    <input type="hidden" name="member" value="[% patron.borrowernumber | html %]" /><input type="text" id="newuserid" name="newuserid" size="20" value="[% patron.userid | html %]" /></li>
    [% SET password_pattern = ".{" _ patron.category.effective_min_password_length _ ",}" %]
    [% IF patron.category.effective_require_strong_password %]
        [% SET password_pattern = '(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{' _ patron.category.effective_min_password_length _ ',}' %]
    [% END %]
    <li>
        <label for="newpassword">New password:</label>

        function generate_password() {
            // Always generate a strong password
            var chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
            var length = [% patron.category.effective_min_password_length | html %];
            if ( length < 8 ) length = 8;
            var password='';
            for ( var i = 0 ; i < length ; i++){

            $("body").on('click', "#fillrandom",function(e) {
                e.preventDefault();
                var password = '';
                var pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% patron.category.effective_min_password_length | html %],}/;
                while ( ! pattern_regex.test( password ) ) {
                    password = generate_password();
                }

            });
        });
    </script>
    [% PROCESS 'password_check.inc' new_password => 'newpassword', minPasswordLength => patron.category.effective_min_password_length, RequireStrongPassword => patron.category.effective_require_strong_password %]
    [% PROCESS 'add_password_check' new_password => 'newpassword' %]
[% END %]

[% INCLUDE 'intranet-bottom.inc' %]




                                                            [% IF ( typeloo.typename_X ) %]<optgroup label="Statistical">[% END %]
                                                        [% END %]
                                                        [% IF ( categoryloo.categorycodeselected ) %]
                                                            <option value="[% categoryloo.categorycode | html %]" selected="selected" data-pwd-length="[% categoryloo.effective_min_password_length | html %]" data-pwd-strong="[% categoryloo.effective_require_strong_password | html %]" data-typename="[% typeloo.typename | html %]">[% categoryloo.categoryname | html %]</option>
                                                        [% ELSE %]
                                                            <option value="[% categoryloo.categorycode | html %]" data-pwd-length="[% categoryloo.effective_min_password_length | html %]" data-pwd-strong="[% categoryloo.effective_require_strong_password | html %]" data-typename="[% typeloo.typename | html %]">[% categoryloo.categoryname | html %]</option>
                                                        [% END %]
                                                        [% IF ( loop.last ) %]
                                                            </optgroup>

    </script>
    [% Asset.js("js/members.js") | $raw %]
    [% Asset.js("js/messaging-preference-form.js") | $raw %]
    [% PROCESS 'password_check.inc' new_password => 'password', category_selector => '#categorycode_entry', minPasswordLength => patron.category.effective_min_password_length, RequireStrongPassword => patron.category.effective_require_strong_password %]
    [% PROCESS 'add_password_check' new_password => 'password' %]
[% END %]

[% INCLUDE 'intranet-bottom.inc' %]

Lines 61-67 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt (-3 / +2 lines)
61	<label for="categorycode_entry" class="required"> Patron category</label>	61	<label for="categorycode_entry" class="required"> Patron category</label>
62	<select id="categorycode_entry" name="categorycode_entry">	62	<select id="categorycode_entry" name="categorycode_entry">
63	[% FOREACH category IN categories %]	63	[% FOREACH category IN categories %]
64	<option value = "[% category.categorycode \| html %]">[% category.description \| html %]</option>	64	<option value = "[% category.categorycode \| html %]" data-pwd-length="[% category.effective_min_password_length \| html %]" data-pwd-strong="[% category.effective_require_strong_password \| html %]">[% category.description \| html %]</option>
65	[% END %]	65	[% END %]
66	</select>	66	</select>
67	<span class="required">Required</span><br><br>	67	<span class="required">Required</span><br><br>
Lines 116-123 Link Here
116	[% INCLUDE 'validator-strings.inc' %]	116	[% INCLUDE 'validator-strings.inc' %]
117	[% INCLUDE 'installer-strings.inc' %]	117	[% INCLUDE 'installer-strings.inc' %]
118	[% Asset.js("js/onboarding.js") \| $raw %]	118	[% Asset.js("js/onboarding.js") \| $raw %]
119	[% PROCESS 'password_check.inc' %]	119	[% PROCESS 'password_check.inc' new_password => 'password', category_selector => '#categorycode_entry', RequireStrongPassword => Koha.Preference('RequireStrongPassword') %]
120	[% PROCESS 'add_password_check' new_password => 'password' %]
121	[% END %]	120	[% END %]
122		121
123	[% INCLUDE 'installer-intranet-bottom.inc' %]	122	[% INCLUDE 'installer-intranet-bottom.inc' %]




[% USE Koha %]
[% BLOCK add_password_check %]
<script>
    var pwd_title = "";
    var pattern_title = "";
    var new_password_node_name = "[% new_password | html %]";
    var category_selector = "[% category_selector | html %]";
    var STRONG_MSG = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers");
    var WEAK_MSG = _("Password must contain at least %s characters");

    if(category_selector && $('select'+category_selector).length) {
        jQuery.validator.addMethod("password_strong", function(value, element){
            var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong');
            var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength');
            var regex_text = require_strong?"(?=.*\\d)(?=.*[a-z])(?=.*[A-Z]).{"+min_lenght+",}":".{"+min_lenght+",}";
            var pattern_regex = new RegExp(regex_text);
            return this.optional(element) || pattern_regex.test(value);
        }, function(unused, element) {
            var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong');
            var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength');
            return (require_strong?STRONG_MSG:WEAK_MSG).format(min_lenght)
        });
    } else {
        [% IF RequireStrongPassword %]
            pwd_title = STRONG_MSG.format([% minPasswordLength | html %]);
            pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% minPasswordLength | html %],}/;
        [% ELSIF minPasswordLength %]
            pwd_title = WEAK_MSG.format([% minPasswordLength | html %]);
            pattern_regex = /.{[% minPasswordLength | html %],}/;
        [% END %]
        jQuery.validator.addMethod("password_strong", function(value, element){
            return this.optional(element) || value == '****' || pattern_regex.test(value);
        }, pwd_title);
    }
    jQuery.validator.addMethod("password_no_spaces", function(value, element){
        return ( this.optional(element) || !value.match(/^\s/) && !value.match(/\s$/) );
    }, _("Password contains leading and/or trailing spaces"));
    jQuery.validator.addMethod("password_match", function(value, element){
        var new_password_node = $("input[name='" + new_password_node_name + "']:first");
        return value == $(new_password_node).val();
    }, _("Please enter the same password as above"));
</script>
[% END %]




                                [% IF field == "B_email" %]<li>Alternate address information: <a href="#borrower_B_email">email address</a></li>[% END %]
                                [% IF field == "password_match" %]<li>Passwords do not match! <a href="#password">password</a></li>[% END %]
                                [% IF field == "password_too_short" %]
                                    <li>Password must be at least [% patron.category.effective_min_password_length | html %] characters long.</li>
                                [% END %]
                                [% IF field == "password_too_weak" %]
                                    <li>Password must contain at least one digit, one lowercase and one uppercase.</li>

                                            <select id="borrower_categorycode" name="borrower_categorycode">
                                                [% FOREACH c IN Categories.all() %]
                                                    [% IF c.categorycode == Koha.Preference('PatronSelfRegistrationDefaultCategory') %]
                                                        <option value="[% c.categorycode | html %]" data-pwd-length="[% c.effective_min_password_length | html %]" data-pwd-strong="[% c.effective_require_strong_password | html %]" selected="selected">[% c.description | html %]</option>
                                                    [% ELSE %]
                                                        <option value="[% c.categorycode | html %]" data-pwd-length="[% c.effective_min_password_length | html %]" data-pwd-strong="[% c.effective_require_strong_password | html %]">[% c.description | html %]</option>
                                                    [% END %]
                                                [% END %]
                                            </select>

                    <fieldset class="rows" id="memberentry_password">
                        <legend id="contact_legend">Password</legend>
                        <div class="alert alert-info">
                            [% IF patron %]
                                [% IF ( patron.category.effective_require_strong_password ) %]
                                    <p>Your password must contain at least [% patron.category.effective_min_password_length | html %] characters, including UPPERCASE, lowercase and numbers.</p>
                                [% ELSE %]
                                    <p>Your password must be at least [% patron.category.effective_min_password_length | html %] characters long.</p>
                                [% END %]
                            [% ELSE %]
                                <p id="password_alert"></p>
                            [% END %]
                            [% UNLESS mandatory.defined('password') %]
                                <p>If you do not enter a password a system generated password will be created.</p>

[% INCLUDE 'opac-bottom.inc' %]
[% BLOCK jsinclude %]
    [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %]

    [% PROCESS 'add_password_check' new_password => 'borrower_password' %]
    <script>
        //<![CDATA[
        $(document).ready(function() {

            });
        });
    [% END %]

    [% UNLESS patron %]
        var PWD_STRONG_MSG = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers");
        var PWD_WEAK_MSG = _("Password must contain at least %s characters");
        $(document).ready(function() {
            var setPwdMessage = function() {
                var require_strong = $('select#borrower_categorycode option:selected').data('pwdStrong');
                var min_lenght = $('select#borrower_categorycode option:selected').data('pwdLength');
                $('#password_alert').html((require_strong?PWD_STRONG_MSG:PWD_WEAK_MSG).format(min_lenght));
            };
            setPwdMessage();
            $('select#borrower_categorycode').change(setPwdMessage);
        });
    [% END %]
    //]]>
    </script>
    [% PROCESS 'password_check.inc' new_password => 'borrower_password', category_selector => '#borrower_categorycode', RequireStrongPassword => patron.category.effective_require_strong_password, minPasswordLength => patron.category.effective_min_password_length %]

[% END %]





                            <form action="/cgi-bin/koha/opac-passwd.pl" name="mainform" id="mainform" method="post" autocomplete="off">
                                <fieldset>
                                    [% IF ( logged_in_user.category.effective_require_strong_password ) %]
                                        <div class="alert alert-info">Your password must contain at least [% logged_in_user.category.effective_min_password_length | html %] characters, including UPPERCASE, lowercase and numbers.</div>
                                    [% ELSE %]
                                        <div class="alert alert-info">Your password must be at least [% logged_in_user.category.effective_min_password_length | html %] characters long.</div>
                                    [% END %]
                                    <label for="Oldkey">Current password:</label> <input type="password" id="Oldkey" size="25"  name="Oldkey" />
                                    <label for="Newkey">New password:</label> <input type="password" id="Newkey"  size="25"  name="Newkey" />

[% INCLUDE 'opac-bottom.inc' %]
[% BLOCK jsinclude %]
    [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %]
    [% PROCESS 'password_check.inc' new_password => 'Newkey', minPasswordLength => logged_in_user.category.effective_min_password_length, RequireStrongPassword => logged_in_user.category.effective_require_strong_password %]
    [% PROCESS 'add_password_check' new_password => 'Newkey' %]
    <script>
        $(document).ready(function() {
            $("#mainform").validate({

Lines 107-116 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt (-3 / +3 lines)
107	<form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">	107	<form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
108	<input type="hidden" name="koha_login_context" value="opac" />	108	<input type="hidden" name="koha_login_context" value="opac" />
109	<fieldset>	109	<fieldset>
110	[% IF ( Koha.Preference('RequireStrongPassword') ) %]	110	[% IF ( RequireStrongPassword ) %]
111	<div class="alert alert-info">Your password must contain at least [% Koha.Preference('minPasswordLength') \| html %] characters, including UPPERCASE, lowercase and numbers.</div>	111	<div class="alert alert-info">Your password must contain at least [% minPasswordLength \| html %] characters, including UPPERCASE, lowercase and numbers.</div>
112	[% ELSE %]	112	[% ELSE %]
113	<div class="alert alert-info">Your password must be at least [% Koha.Preference('minPasswordLength') \| html %] characters long.</div>	113	<div class="alert alert-info">Your password must be at least [% minPasswordLength \| html %] characters long.</div>
114	[% END %]	114	[% END %]
115	<label for="password">New password:</label>	115	<label for="password">New password:</label>
116	<input type="password" id="password" size="40" name="password" />	116	<input type="password" id="password" size="40" name="password" />

Lines 367-373 if ($op eq 'save' \|\| $op eq 'insert'){ Link Here

(-)a/members/memberentry.pl (-2 / +4 lines)
367	# the edited values list when editing certain sub-forms. Get it straight	367	# the edited values list when editing certain sub-forms. Get it straight
368	# from the DB if absent.	368	# from the DB if absent.
369	my $userid = $newdata{ userid } // $borrower_data->{ userid };	369	my $userid = $newdata{ userid } // $borrower_data->{ userid };
370	my $p = $borrowernumber ? Koha::Patrons->find( $borrowernumber ) : Koha::Patron->new;	370	my $p = $borrowernumber ? Koha::Patrons->find( $borrowernumber ) : Koha::Patron->new();
371	$p->userid( $userid );	371	$p->userid( $userid );
372	unless ( $p->has_valid_userid ) {	372	unless ( $p->has_valid_userid ) {
373	push @errors, "ERROR_login_exist";	373	push @errors, "ERROR_login_exist";
Lines 378-384 if ($op eq 'save' \|\| $op eq 'insert'){ Link Here
378	push @errors, "ERROR_password_mismatch" if ( $password ne $password2 );	378	push @errors, "ERROR_password_mismatch" if ( $password ne $password2 );
379		379
380	if ( $password and $password ne '****' ) {	380	if ( $password and $password ne '****' ) {
381	my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $password );	381	my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $password, Koha::Patron::Categories->find($categorycode) );
382	unless ( $is_valid ) {	382	unless ( $is_valid ) {
383	push @errors, 'ERROR_password_too_short' if $error eq 'too_short';	383	push @errors, 'ERROR_password_too_short' if $error eq 'too_short';
384	push @errors, 'ERROR_password_too_weak' if $error eq 'too_weak';	384	push @errors, 'ERROR_password_too_weak' if $error eq 'too_weak';
Lines 669-674 foreach my $category_type (qw(C A S P I X)) { Link Here
669	push @categoryloop,	669	push @categoryloop,
670	{ 'categorycode' => $patron_category->categorycode,	670	{ 'categorycode' => $patron_category->categorycode,
671	'categoryname' => $patron_category->description,	671	'categoryname' => $patron_category->description,
		672	'effective_min_password_length' => $patron_category->effective_min_password_length,
		673	'effective_require_strong_password' => $patron_category->effective_require_strong_password,
672	'categorycodeselected' =>	674	'categorycodeselected' =>
673	( defined($categorycode) && $patron_category->categorycode eq $categorycode ),	675	( defined($categorycode) && $patron_category->categorycode eq $categorycode ),
674	};	676	};




    pod2usage("cardnumber is mandatory")   unless $cardnumber;
}

unless ($password) {
    my $generator  = String::Random->new( rand_gen => \&alt_rand );
    $password      = $generator->randregex('[A-Za-z][A-Za-z0-9_]{6}.[A-Za-z][A-Za-z0-9_]{6}\d');
}

my $filter;

if ( $userid ) {

}

my $patron = $patrons->next;

unless ($password) {
    my $generator  = String::Random->new( rand_gen => \&alt_rand );
    my $n = $patron->category->effective_min_password_length;
    $n = $n<6?6:$n;
    $password      = $generator->randregex('[A-Za-z][A-Za-z0-9_]{6}.[A-Za-z][A-Za-z0-9_]{'.$n.'}\d');
}

$patron->set_password({ password => $password, skip_validation => 1 });

print $patron->userid . " " . $password . "\n";




use Koha::Patron::Images;
use Koha::Patron::Modification;
use Koha::Patron::Modifications;
use Koha::Patron::Categories;
use Koha::Token;

my $cgi = new CGI;

                $verification_token = md5_hex( time().{}.rand().{}.$$ );
            }

            $borrower{password}          = Koha::AuthUtils::generate_password(Koha::Patron::Categories->find($borrower{categorycode})) unless $borrower{password};
            $borrower{verification_token} = $verification_token;

            Koha::Patron::Modification->new( \%borrower )->store();

            );

            $borrower{categorycode}     ||= C4::Context->preference('PatronSelfRegistrationDefaultCategory');
            $borrower{password}         ||= Koha::AuthUtils::generate_password(Koha::Patron::Categories->find($borrower{categorycode}));
            my $consent_dt = delete $borrower{gdpr_proc_consent};
            my $patron = Koha::Patron->new( \%borrower )->store;
            Koha::Patron::Consent->new({ borrowernumber => $patron->borrowernumber, type => 'GDPR_PROCESSING', given_on => $consent_dt })->store if $consent_dt;

        push( @invalidFields, "password_match" );
    }
    if ( $borrower->{'password'} ) {
        my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $borrower->{password}, Koha::Patron::Categories->find($borrower->{categorycode}) );
          unless ( $is_valid ) {
              push @invalidFields, 'password_too_short' if $error eq 'too_short';
              push @invalidFields, 'password_too_weak' if $error eq 'too_weak';

Lines 54-60 if ( $query->param('sendEmail') \|\| $query->param('resendEmail') ) { Link Here

(-)a/opac/opac-password-recovery.pl (-2 / +13 lines)
54	#try with the main email	54	#try with the main email
55	my $borrower;	55	my $borrower;
56	my $search_results;	56	my $search_results;
57
58	# Find the borrower by userid, card number, or email	57	# Find the borrower by userid, card number, or email
59	if ($username) {	58	if ($username) {
60	$search_results = Koha::Patrons->search( { -or => { userid => $username, cardnumber => $username }, login_attempts => { '!=', Koha::Patron::ADMINISTRATIVE_LOCKOUT } } );	59	$search_results = Koha::Patrons->search( { -or => { userid => $username, cardnumber => $username }, login_attempts => { '!=', Koha::Patron::ADMINISTRATIVE_LOCKOUT } } );
Lines 124-129 if ( $query->param('sendEmail') \|\| $query->param('resendEmail') ) { Link Here
124	if ($hasError) {	123	if ($hasError) {
125	$template->param(	124	$template->param(
126	hasError => 1,	125	hasError => 1,
		126
127	errNoBorrowerFound => $errNoBorrowerFound,	127	errNoBorrowerFound => $errNoBorrowerFound,
128	errTooManyEmailFound => $errTooManyEmailFound,	128	errTooManyEmailFound => $errTooManyEmailFound,
129	errAlreadyStartRecovery => $errAlreadyStartRecovery,	129	errAlreadyStartRecovery => $errAlreadyStartRecovery,
Lines 154-166 elsif ( $query->param('passwordReset') ) { Link Here
154	( $borrower_number, $username ) = GetValidLinkInfo($uniqueKey);	154	( $borrower_number, $username ) = GetValidLinkInfo($uniqueKey);
155		155
156	my $error;	156	my $error;
		157	my $min_password_length = C4::Context->preference('minPasswordPreference');
		158	my $require_strong_password = C4::Context->preference('RequireStrongPassword');
157	if ( not $borrower_number ) {	159	if ( not $borrower_number ) {
158	$error = 'errLinkNotValid';	160	$error = 'errLinkNotValid';
159	} elsif ( $password ne $repeatPassword ) {	161	} elsif ( $password ne $repeatPassword ) {
160	$error = 'errPassNotMatch';	162	$error = 'errPassNotMatch';
161	} else {	163	} else {
		164	my $borrower = Koha::Patrons->find($borrower_number);
		165	$min_password_length = $borrower->category->effective_min_password_length;
		166	$require_strong_password = $borrower->category->effective_require_strong_password;
162	try {	167	try {
163	Koha::Patrons->find($borrower_number)->set_password({ password => $password });	168	$borrower->set_password({ password => $password });
164		169
165	CompletePasswordRecovery($uniqueKey);	170	CompletePasswordRecovery($uniqueKey);
166	$template->param(	171	$template->param(
Lines 187-192 elsif ( $query->param('passwordReset') ) { Link Here
187	uniqueKey => $uniqueKey,	192	uniqueKey => $uniqueKey,
188	hasError => 1,	193	hasError => 1,
189	$error => 1,	194	$error => 1,
		195	minPasswordLength => $min_password_length,
		196	RequireStrongPassword => $require_strong_password
190	);	197	);
191	}	198	}
192	}	199	}
Lines 198-203 elsif ($uniqueKey) { #reset password form Link Here
198	$errLinkNotValid = 1;	205	$errLinkNotValid = 1;
199	}	206	}
200		207
		208	my $borrower = Koha::Patrons->find($borrower_number);
		209
201	$template->param(	210	$template->param(
202	new_password => 1,	211	new_password => 1,
203	email => $email,	212	email => $email,
Lines 205-210 elsif ($uniqueKey) { #reset password form Link Here
205	username => $username,	214	username => $username,
206	errLinkNotValid => $errLinkNotValid,	215	errLinkNotValid => $errLinkNotValid,
207	hasError => ( $errLinkNotValid ? 1 : 0 ),	216	hasError => ( $errLinkNotValid ? 1 : 0 ),
		217	minPasswordLength => $borrower->category->effective_min_password_length,
		218	RequireStrongPassword => $borrower->category->effective_require_strong_password
208	);	219	);
209	}	220	}
210	else { #password recovery form (to send email)	221	else { #password recovery form (to send email)

Lines 27-32 use Koha::AuthUtils; Link Here

(-)a/opac/opac-registration-verify.pl (-2 / +2 lines)
27	use Koha::Patrons;	27	use Koha::Patrons;
28	use Koha::Patron::Consent;	28	use Koha::Patron::Consent;
29	use Koha::Patron::Modifications;	29	use Koha::Patron::Modifications;
		30	use Koha::Patron::Categories;
30		31
31	my $cgi = new CGI;	32	my $cgi = new CGI;
32	my $dbh = C4::Context->dbh;	33	my $dbh = C4::Context->dbh;
Lines 59-65 if ( Link Here
59	);	60	);
60		61
61	my $patron_attrs = $m->unblessed;	62	my $patron_attrs = $m->unblessed;
62	$patron_attrs->{password} \|\|= Koha::AuthUtils::generate_password;	63	$patron_attrs->{password} \|\|= Koha::AuthUtils::generate_password(Koha::Patron::Categories->find($patron_attrs->{categorycode}));
63	my $consent_dt = delete $patron_attrs->{gdpr_proc_consent};	64	my $consent_dt = delete $patron_attrs->{gdpr_proc_consent};
64	$patron_attrs->{categorycode} \|\|= C4::Context->preference('PatronSelfRegistrationDefaultCategory');	65	$patron_attrs->{categorycode} \|\|= C4::Context->preference('PatronSelfRegistrationDefaultCategory');
65	delete $patron_attrs->{timestamp};	66	delete $patron_attrs->{timestamp};
66	-

Return to bug 23816

Lines 255-260 sub effective_change_password { Link Here

(-)a/Koha/Patron/Category.pm (+32 lines)
255	: C4::Context->preference('OpacPasswordChange');	255	: C4::Context->preference('OpacPasswordChange');
256	}	256	}
257		257
		258	=head3 effective_min_password_length
		259
		260	$category->effective_min_password_length()
		261
		262	Retrieve category's password length if setted, or minPasswordLength otherwise
		263
		264	=cut
		265
		266	sub effective_min_password_length {
		267	my ($self) = @_;
		268
		269	return C4::Context->preference('minPasswordLength') unless defined $self->min_password_length;
		270
		271	return $self->min_password_length;
		272	}
		273
		274	=head3 effective_require_strong_password
		275
		276	$category->effective_require_strong_password()
		277
		278	Retrieve category's password strength if setted, or RequireStrongPassword otherwise
		279
		280	=cut
		281
		282	sub effective_require_strong_password {
		283	my ($self) = @_;
		284
		285	return C4::Context->preference('RequireStrongPassword') unless defined $self->require_strong_password;
		286
		287	return $self->require_strong_password;
		288	}
		289
258	=head3 override_hidden_items	290	=head3 override_hidden_items
259		291
260	if ( $patron->category->override_hidden_items ) {	292	if ( $patron->category->override_hidden_items ) {

Lines 830-838 legend:hover { Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt (-4 / +3 lines)
830	[% IF ( typeloo.typename_X ) %]<optgroup label="Statistical">[% END %]	830	[% IF ( typeloo.typename_X ) %]<optgroup label="Statistical">[% END %]
831	[% END %]	831	[% END %]
832	[% IF ( categoryloo.categorycodeselected ) %]	832	[% IF ( categoryloo.categorycodeselected ) %]
833	<option value="[% categoryloo.categorycode \| html %]" selected="selected" data-typename="[% typeloo.typename \| html %]">[% categoryloo.categoryname \| html %]</option>	833	<option value="[% categoryloo.categorycode \| html %]" selected="selected" data-pwd-length="[% categoryloo.effective_min_password_length \| html %]" data-pwd-strong="[% categoryloo.effective_require_strong_password \| html %]" data-typename="[% typeloo.typename \| html %]">[% categoryloo.categoryname \| html %]</option>
834	[% ELSE %]	834	[% ELSE %]
835	<option value="[% categoryloo.categorycode \| html %]" data-typename="[% typeloo.typename \| html %]">[% categoryloo.categoryname \| html %]</option>	835	<option value="[% categoryloo.categorycode \| html %]" data-pwd-length="[% categoryloo.effective_min_password_length \| html %]" data-pwd-strong="[% categoryloo.effective_require_strong_password \| html %]" data-typename="[% typeloo.typename \| html %]">[% categoryloo.categoryname \| html %]</option>
836	[% END %]	836	[% END %]
837	[% IF ( loop.last ) %]	837	[% IF ( loop.last ) %]
838	</optgroup>	838	</optgroup>
Lines 1730-1737 legend:hover { Link Here
1730	</script>	1730	</script>
1731	[% Asset.js("js/members.js") \| $raw %]	1731	[% Asset.js("js/members.js") \| $raw %]
1732	[% Asset.js("js/messaging-preference-form.js") \| $raw %]	1732	[% Asset.js("js/messaging-preference-form.js") \| $raw %]
1733	[% PROCESS 'password_check.inc' %]	1733	[% PROCESS 'password_check.inc' new_password => 'password', category_selector => '#categorycode_entry', minPasswordLength => patron.category.effective_min_password_length, RequireStrongPassword => patron.category.effective_require_strong_password %]
1734	[% PROCESS 'add_password_check' new_password => 'password' %]
1735	[% END %]	1734	[% END %]
1736		1735
1737	[% INCLUDE 'intranet-bottom.inc' %]	1736	[% INCLUDE 'intranet-bottom.inc' %]

Lines 82-88 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt (-9 / +27 lines)
82	[% IF field == "B_email" %]<li>Alternate address information: <a href="#borrower_B_email">email address</a></li>[% END %]	82	[% IF field == "B_email" %]<li>Alternate address information: <a href="#borrower_B_email">email address</a></li>[% END %]
83	[% IF field == "password_match" %]<li>Passwords do not match! <a href="#password">password</a></li>[% END %]	83	[% IF field == "password_match" %]<li>Passwords do not match! <a href="#password">password</a></li>[% END %]
84	[% IF field == "password_too_short" %]	84	[% IF field == "password_too_short" %]
85	<li>Password must be at least [% minPasswordLength \| html %] characters long.</li>	85	<li>Password must be at least [% patron.category.effective_min_password_length \| html %] characters long.</li>
86	[% END %]	86	[% END %]
87	[% IF field == "password_too_weak" %]	87	[% IF field == "password_too_weak" %]
88	<li>Password must contain at least one digit, one lowercase and one uppercase.</li>	88	<li>Password must contain at least one digit, one lowercase and one uppercase.</li>
Lines 252-260 Link Here
252	<select id="borrower_categorycode" name="borrower_categorycode">	252	<select id="borrower_categorycode" name="borrower_categorycode">
253	[% FOREACH c IN Categories.all() %]	253	[% FOREACH c IN Categories.all() %]
254	[% IF c.categorycode == Koha.Preference('PatronSelfRegistrationDefaultCategory') %]	254	[% IF c.categorycode == Koha.Preference('PatronSelfRegistrationDefaultCategory') %]
255	<option value="[% c.categorycode \| html %]" selected="selected">[% c.description \| html %]</option>	255	<option value="[% c.categorycode \| html %]" data-pwd-length="[% c.effective_min_password_length \| html %]" data-pwd-strong="[% c.effective_require_strong_password \| html %]" selected="selected">[% c.description \| html %]</option>
256	[% ELSE %]	256	[% ELSE %]
257	<option value="[% c.categorycode \| html %]">[% c.description \| html %]</option>	257	<option value="[% c.categorycode \| html %]" data-pwd-length="[% c.effective_min_password_length \| html %]" data-pwd-strong="[% c.effective_require_strong_password \| html %]">[% c.description \| html %]</option>
258	[% END %]	258	[% END %]
259	[% END %]	259	[% END %]
260	</select>	260	</select>
Lines 866-875 Link Here
866	<fieldset class="rows" id="memberentry_password">	866	<fieldset class="rows" id="memberentry_password">
867	<legend id="contact_legend">Password</legend>	867	<legend id="contact_legend">Password</legend>
868	<div class="alert alert-info">	868	<div class="alert alert-info">
869	[% IF ( Koha.Preference('RequireStrongPassword') ) %]	869	[% IF patron %]
870	<p>Your password must contain at least [% Koha.Preference('minPasswordLength') \| html %] characters, including UPPERCASE, lowercase and numbers.</p>	870	[% IF ( patron.category.effective_require_strong_password ) %]
		871	<p>Your password must contain at least [% patron.category.effective_min_password_length \| html %] characters, including UPPERCASE, lowercase and numbers.</p>
		872	[% ELSE %]
		873	<p>Your password must be at least [% patron.category.effective_min_password_length \| html %] characters long.</p>
		874	[% END %]
871	[% ELSE %]	875	[% ELSE %]
872	<p>Your password must be at least [% Koha.Preference('minPasswordLength') \| html %] characters long.</p>	876	<p id="password_alert"></p>
873	[% END %]	877	[% END %]
874	[% UNLESS mandatory.defined('password') %]	878	[% UNLESS mandatory.defined('password') %]
875	<p>If you do not enter a password a system generated password will be created.</p>	879	<p>If you do not enter a password a system generated password will be created.</p>
Lines 1016-1023 Link Here
1016	[% INCLUDE 'opac-bottom.inc' %]	1020	[% INCLUDE 'opac-bottom.inc' %]
1017	[% BLOCK jsinclude %]	1021	[% BLOCK jsinclude %]
1018	[% Asset.js("lib/jquery/plugins/jquery.validate.min.js") \| $raw %]	1022	[% Asset.js("lib/jquery/plugins/jquery.validate.min.js") \| $raw %]
1019	[% PROCESS 'password_check.inc' %]	1023
1020	[% PROCESS 'add_password_check' new_password => 'borrower_password' %]
1021	<script>	1024	<script>
1022	//<![CDATA[	1025	//<![CDATA[
1023	$(document).ready(function() {	1026	$(document).ready(function() {
Lines 1178-1184 Link Here
1178	});	1181	});
1179	});	1182	});
1180	[% END %]	1183	[% END %]
		1184
		1185	[% UNLESS patron %]
		1186	var PWD_STRONG_MSG = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers");
		1187	var PWD_WEAK_MSG = _("Password must contain at least %s characters");
		1188	$(document).ready(function() {
		1189	var setPwdMessage = function() {
		1190	var require_strong = $('select#borrower_categorycode option:selected').data('pwdStrong');
		1191	var min_lenght = $('select#borrower_categorycode option:selected').data('pwdLength');
		1192	$('#password_alert').html((require_strong?PWD_STRONG_MSG:PWD_WEAK_MSG).format(min_lenght));
		1193	};
		1194	setPwdMessage();
		1195	$('select#borrower_categorycode').change(setPwdMessage);
		1196	});
		1197	[% END %]
1181	//]]>	1198	//]]>
1182	</script>	1199	</script>
1183	[% INCLUDE 'calendar.inc' %]	1200	[% PROCESS 'password_check.inc' new_password => 'borrower_password', category_selector => '#borrower_categorycode', RequireStrongPassword => patron.category.effective_require_strong_password, minPasswordLength => patron.category.effective_min_password_length %]
		1201
1184	[% END %]	1202	[% END %]

Lines 139-159 sub generate_salt { Link Here

(-)a/Koha/AuthUtils.pm (-9 / +10 lines)
139		139
140	=head2 is_password_valid	140	=head2 is_password_valid
141		141
142	my ( $is_valid, $error ) = is_password_valid( $password );	142	my ( $is_valid, $error ) = is_password_valid( $password, $category );
143		143
144	return $is_valid == 1 if the password match minPasswordLength and RequireStrongPassword conditions	144	return $is_valid == 1 if the password match category's minimum password length and strength if provided, or general minPasswordLength and RequireStrongPassword conditions
145	otherwise return $is_valid == 0 and $error will contain the error ('too_short' or 'too_weak')	145	otherwise return $is_valid == 0 and $error will contain the error ('too_short' or 'too_weak')
146		146
147	=cut	147	=cut
148		148
149	sub is_password_valid {	149	sub is_password_valid {
150	my ($password) = @_;	150	my ($password, $category) = @_;
151	my $minPasswordLength = C4::Context->preference('minPasswordLength');	151	my $minPasswordLength = $category?$category->effective_min_password_length:C4::Context->preference('minPasswordLength');
152	$minPasswordLength = 3 if not $minPasswordLength or $minPasswordLength < 3;	152	$minPasswordLength = 3 if not $minPasswordLength or $minPasswordLength < 3;
153	if ( length($password) < $minPasswordLength ) {	153	if ( length($password) < $minPasswordLength ) {
154	return ( 0, 'too_short' );	154	return ( 0, 'too_short' );
155	}	155	}
156	elsif ( C4::Context->preference('RequireStrongPassword') ) {	156	elsif ( $category?$category->effective_require_strong_password:C4::Context->preference('RequireStrongPassword') ) {
157	return ( 0, 'too_weak' )	157	return ( 0, 'too_weak' )
158	if $password !~ m\|(?=.\d)(?=.[a-z])(?=.*[A-Z]).{$minPasswordLength,}\|;	158	if $password !~ m\|(?=.\d)(?=.[a-z])(?=.*[A-Z]).{$minPasswordLength,}\|;
159	}	159	}
Lines 163-182 sub is_password_valid { Link Here
163		163
164	=head2 generate_password	164	=head2 generate_password
165		165
166	my password = generate_password();	166	my password = generate_password($category);
167		167
168	Generate a password according to the minPasswordLength and RequireStrongPassword.	168	Generate a password according to category's minimum password length and strength if provided, or to the minPasswordLength and RequireStrongPassword system preferences.
169		169
170	=cut	170	=cut
171		171
172	sub generate_password {	172	sub generate_password {
173	my $minPasswordLength = C4::Context->preference('minPasswordLength');	173	my ($category) = @_;
		174	my $minPasswordLength = $category?$category->effective_min_password_length:C4::Context->preference('minPasswordLength');
174	$minPasswordLength = 8 if not $minPasswordLength or $minPasswordLength < 8;	175	$minPasswordLength = 8 if not $minPasswordLength or $minPasswordLength < 8;
175		176
176	my ( $password, $is_valid );	177	my ( $password, $is_valid );
177	do {	178	do {
178	$password = random_string('.' x $minPasswordLength );	179	$password = random_string('.' x $minPasswordLength );
179	( $is_valid, undef ) = is_password_valid( $password );	180	( $is_valid, undef ) = is_password_valid( $password, $category );
180	} while not $is_valid;	181	} while not $is_valid;
181	return $password;	182	return $password;
182	}	183	}

Lines 1-20 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/password_check.inc (-12 / +28 lines)
1	[% USE Koha %]	1	[% USE Koha %]
2	[% BLOCK add_password_check %]
3	<!-- password_check.inc -->	2	<!-- password_check.inc -->
4	<script>	3	<script>
5	var pwd_title = "";	4	var pwd_title = "";
6	var pattern_title = "";	5	var pattern_title = "";
7	var new_password_node_name = "[% new_password \| html %]";	6	var new_password_node_name = "[% new_password \| html %]";
8	[% IF Koha.Preference('RequireStrongPassword') %]	7	var category_selector = "[% category_selector \| html %]";
9	pwd_title = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers").format([% minPasswordLength \| html %]);	8	var STRONG_MSG = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers");
10	pattern_regex = /(?=.\d)(?=.[a-z])(?=.*[A-Z]).{[% minPasswordLength \| html %],}/;	9	var WEAK_MSG = _("Password must contain at least %s characters");
11	[% ELSIF minPasswordLength %]	10
12	pwd_title = _("Password must contain at least %s characters").format([% minPasswordLength \| html %]);	11	if(category_selector && $('select'+category_selector).length) {
13	pattern_regex = /.{[% minPasswordLength \| html %],}/;	12	jQuery.validator.addMethod("password_strong", function(value, element){
14	[% END %]	13	var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong');
15	jQuery.validator.addMethod("password_strong", function(value, element){	14	var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength');
16	return this.optional(element) \|\| value == '****' \|\| pattern_regex.test(value);	15	var regex_text = require_strong?"(?=.\\d)(?=.[a-z])(?=.*[A-Z]).{"+min_lenght+",}":".{"+min_lenght+",}";
17	}, pwd_title);	16	var pattern_regex = new RegExp(regex_text);
		17	return this.optional(element) \|\| pattern_regex.test(value);
		18	}, function(unused, element) {
		19	var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong');
		20	var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength');
		21	return (require_strong?STRONG_MSG:WEAK_MSG).format(min_lenght)
		22	});
		23	} else {
		24	[% IF RequireStrongPassword %]
		25	pwd_title = STRONG_MSG.format([% minPasswordLength \| html %]);
		26	pattern_regex = /(?=.\d)(?=.[a-z])(?=.*[A-Z]).{[% minPasswordLength \| html %],}/;
		27	[% ELSIF minPasswordLength %]
		28	pwd_title = WEAK_MSG.format([% minPasswordLength \| html %]);
		29	pattern_regex = /.{[% minPasswordLength \| html %],}/;
		30	[% END %]
		31	jQuery.validator.addMethod("password_strong", function(value, element){
		32	return this.optional(element) \|\| value == '****' \|\| pattern_regex.test(value);
		33	}, pwd_title);
		34	}
18	jQuery.validator.addMethod("password_no_spaces", function(value, element){	35	jQuery.validator.addMethod("password_no_spaces", function(value, element){
19	return ( this.optional(element) \|\| !value.match(/^\s/) && !value.match(/\s$/) );	36	return ( this.optional(element) \|\| !value.match(/^\s/) && !value.match(/\s$/) );
20	}, _("Password contains leading and/or trailing spaces"));	37	}, _("Password contains leading and/or trailing spaces"));
Lines 24-27 Link Here
24	}, _("Please enter the same password as above"));	41	}, _("Please enter the same password as above"));
25	</script>	42	</script>
26	<!-- / password_check.inc -->	43	<!-- / password_check.inc -->
27	[% END %]

Lines 37-43 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt (-8 / +7 lines)
37	<li>You have entered a username that already exists. Please choose another one.</li>	37	<li>You have entered a username that already exists. Please choose another one.</li>
38	[% END %]	38	[% END %]
39	[% IF ( ERROR_password_too_short ) %]	39	[% IF ( ERROR_password_too_short ) %]
40	<li id="ERROR_short_password">Password must be at least [% Koha.Preference('minPasswordLength') \| html %] characters long.</li>	40	<li id="ERROR_short_password">Password must be at least [% patron.category.effective_min_password_length \| html %] characters long.</li>
41	[% END %]	41	[% END %]
42	[% IF ( ERROR_password_too_weak ) %]	42	[% IF ( ERROR_password_too_weak ) %]
43	<li id="ERROR_weak_password">Password must contain at least one digit, one lowercase and one uppercase.</li>	43	<li id="ERROR_weak_password">Password must contain at least one digit, one lowercase and one uppercase.</li>
Lines 63-71 Link Here
63	<ol>	63	<ol>
64	<li><label for="newuserid">New username:</label>	64	<li><label for="newuserid">New username:</label>
65	<input type="hidden" name="member" value="[% patron.borrowernumber \| html %]" /><input type="text" id="newuserid" name="newuserid" size="20" value="[% patron.userid \| html %]" /></li>	65	<input type="hidden" name="member" value="[% patron.borrowernumber \| html %]" /><input type="text" id="newuserid" name="newuserid" size="20" value="[% patron.userid \| html %]" /></li>
66	[% SET password_pattern = ".{" _ Koha.Preference('minPasswordLength') _ ",}" %]	66	[% SET password_pattern = ".{" _ patron.category.effective_min_password_length _ ",}" %]
67	[% IF Koha.Preference('RequireStrongPassword') %]	67	[% IF patron.category.effective_require_strong_password %]
68	[% SET password_pattern = '(?=.\d)(?=.[a-z])(?=.*[A-Z]).{' _ Koha.Preference('minPasswordLength') _ ',}' %]	68	[% SET password_pattern = '(?=.\d)(?=.[a-z])(?=.*[A-Z]).{' _ patron.category.effective_min_password_length _ ',}' %]
69	[% END %]	69	[% END %]
70	<li>	70	<li>
71	<label for="newpassword">New password:</label>	71	<label for="newpassword">New password:</label>
Lines 105-111 Link Here
105	function generate_password() {	105	function generate_password() {
106	// Always generate a strong password	106	// Always generate a strong password
107	var chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';	107	var chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
108	var length = [% Koha.Preference('minPasswordLength') \| html %];	108	var length = [% patron.category.effective_min_password_length \| html %];
109	if ( length < 8 ) length = 8;	109	if ( length < 8 ) length = 8;
110	var password='';	110	var password='';
111	for ( var i = 0 ; i < length ; i++){	111	for ( var i = 0 ; i < length ; i++){
Lines 117-123 Link Here
117	$("body").on('click', "#fillrandom",function(e) {	117	$("body").on('click', "#fillrandom",function(e) {
118	e.preventDefault();	118	e.preventDefault();
119	var password = '';	119	var password = '';
120	var pattern_regex = /(?=.\d)(?=.[a-z])(?=.*[A-Z]).{[% Koha.Preference('minPasswordLength') \| html %],}/;	120	var pattern_regex = /(?=.\d)(?=.[a-z])(?=.*[A-Z]).{[% patron.category.effective_min_password_length \| html %],}/;
121	while ( ! pattern_regex.test( password ) ) {	121	while ( ! pattern_regex.test( password ) ) {
122	password = generate_password();	122	password = generate_password();
123	}	123	}
Lines 156-163 Link Here
156	});	156	});
157	});	157	});
158	</script>	158	</script>
159	[% PROCESS 'password_check.inc' %]	159	[% PROCESS 'password_check.inc' new_password => 'newpassword', minPasswordLength => patron.category.effective_min_password_length, RequireStrongPassword => patron.category.effective_require_strong_password %]
160	[% PROCESS 'add_password_check' new_password => 'newpassword' %]
161	[% END %]	160	[% END %]
162		161
163	[% INCLUDE 'intranet-bottom.inc' %]	162	[% INCLUDE 'intranet-bottom.inc' %]

Lines 1-25 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc (-14 / +30 lines)
1	[% USE Koha %]	1	[% USE Koha %]
2	[% BLOCK add_password_check %]
3	<script>	2	<script>
4	var pwd_title = "";	3	var pwd_title = "";
5	var pattern_title = "";	4	var pattern_title = "";
6	var new_password_node_name = "[% new_password \| html %]";	5	var new_password_node_name = "[% new_password \| html %]";
7	[% IF Koha.Preference('RequireStrongPassword') %]	6	var category_selector = "[% category_selector \| html %]";
8	pwd_title = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers").format([% minPasswordLength \| html %]);	7	var STRONG_MSG = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers");
9	pattern_regex = /(?=.\d)(?=.[a-z])(?=.*[A-Z]).{[% minPasswordLength \| html %],}/;	8	var WEAK_MSG = _("Password must contain at least %s characters");
10	[% ELSIF minPasswordLength %]	9
11	pwd_title = _("Password must contain at least %s characters").format([% minPasswordLength \| html %]);	10	if(category_selector && $('select'+category_selector).length) {
12	pattern_regex = /.{[% minPasswordLength \| html %],}/;	11	jQuery.validator.addMethod("password_strong", function(value, element){
13	[% END %]	12	var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong');
14	jQuery.validator.addMethod("password_strong", function(value, element){	13	var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength');
15	return this.optional(element) \|\| pattern_regex.test(value);	14	var regex_text = require_strong?"(?=.\\d)(?=.[a-z])(?=.*[A-Z]).{"+min_lenght+",}":".{"+min_lenght+",}";
16	}, pwd_title);	15	var pattern_regex = new RegExp(regex_text);
		16	return this.optional(element) \|\| pattern_regex.test(value);
		17	}, function(unused, element) {
		18	var require_strong = $('select'+category_selector+' option:selected').data('pwdStrong');
		19	var min_lenght = $('select'+category_selector+' option:selected').data('pwdLength');
		20	return (require_strong?STRONG_MSG:WEAK_MSG).format(min_lenght)
		21	});
		22	} else {
		23	[% IF RequireStrongPassword %]
		24	pwd_title = STRONG_MSG.format([% minPasswordLength \| html %]);
		25	pattern_regex = /(?=.\d)(?=.[a-z])(?=.*[A-Z]).{[% minPasswordLength \| html %],}/;
		26	[% ELSIF minPasswordLength %]
		27	pwd_title = WEAK_MSG.format([% minPasswordLength \| html %]);
		28	pattern_regex = /.{[% minPasswordLength \| html %],}/;
		29	[% END %]
		30	jQuery.validator.addMethod("password_strong", function(value, element){
		31	return this.optional(element) \|\| value == '****' \|\| pattern_regex.test(value);
		32	}, pwd_title);
		33	}
17	jQuery.validator.addMethod("password_no_spaces", function(value, element){	34	jQuery.validator.addMethod("password_no_spaces", function(value, element){
18	return ( this.optional(element) \|\| !value.match(/^\s/) && !value.match(/\s$/) );	35	return ( this.optional(element) \|\| !value.match(/^\s/) && !value.match(/\s$/) );
19	}, _("Password contains leading and/or trailing spaces"));	36	}, _("Password contains leading and/or trailing spaces"));
20	jQuery.validator.addMethod("password_match", function(value, element){	37	jQuery.validator.addMethod("password_match", function(value, element){
21	var new_password_node = $("input[name='" + new_password_node_name + "']:first");	38	var new_password_node = $("input[name='" + new_password_node_name + "']:first");
22	return this.optional(element) \|\| value == $(new_password_node).val();	39	return value == $(new_password_node).val();
23	}, _("Please enter the same password as above"));	40	}, _("Please enter the same password as above"));
24	</script>	41	</script>
25	[% END %]

Lines 57-66 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt (-5 / +4 lines)
57		57
58	<form action="/cgi-bin/koha/opac-passwd.pl" name="mainform" id="mainform" method="post" autocomplete="off">	58	<form action="/cgi-bin/koha/opac-passwd.pl" name="mainform" id="mainform" method="post" autocomplete="off">
59	<fieldset>	59	<fieldset>
60	[% IF ( Koha.Preference('RequireStrongPassword') ) %]	60	[% IF ( logged_in_user.category.effective_require_strong_password ) %]
61	<div class="alert alert-info">Your password must contain at least [% Koha.Preference('minPasswordLength') \| html %] characters, including UPPERCASE, lowercase and numbers.</div>	61	<div class="alert alert-info">Your password must contain at least [% logged_in_user.category.effective_min_password_length \| html %] characters, including UPPERCASE, lowercase and numbers.</div>
62	[% ELSE %]	62	[% ELSE %]
63	<div class="alert alert-info">Your password must be at least [% Koha.Preference('minPasswordLength') \| html %] characters long.</div>	63	<div class="alert alert-info">Your password must be at least [% logged_in_user.category.effective_min_password_length \| html %] characters long.</div>
64	[% END %]	64	[% END %]
65	<label for="Oldkey">Current password:</label> <input type="password" id="Oldkey" size="25" name="Oldkey" />	65	<label for="Oldkey">Current password:</label> <input type="password" id="Oldkey" size="25" name="Oldkey" />
66	<label for="Newkey">New password:</label> <input type="password" id="Newkey" size="25" name="Newkey" />	66	<label for="Newkey">New password:</label> <input type="password" id="Newkey" size="25" name="Newkey" />
Lines 94-101 Link Here
94	[% INCLUDE 'opac-bottom.inc' %]	94	[% INCLUDE 'opac-bottom.inc' %]
95	[% BLOCK jsinclude %]	95	[% BLOCK jsinclude %]
96	[% Asset.js("lib/jquery/plugins/jquery.validate.min.js") \| $raw %]	96	[% Asset.js("lib/jquery/plugins/jquery.validate.min.js") \| $raw %]
97	[% PROCESS 'password_check.inc' %]	97	[% PROCESS 'password_check.inc' new_password => 'Newkey', minPasswordLength => logged_in_user.category.effective_min_password_length, RequireStrongPassword => logged_in_user.category.effective_require_strong_password %]
98	[% PROCESS 'add_password_check' new_password => 'Newkey' %]
99	<script>	98	<script>
100	$(document).ready(function() {	99	$(document).ready(function() {
101	$("#mainform").validate({	100	$("#mainform").validate({

Lines 44-54 unless ( $userid or $patron_id or $cardnumber ) { Link Here

(-)a/misc/admin/set_password.pl (-5 / +8 lines)
44	pod2usage("cardnumber is mandatory") unless $cardnumber;	44	pod2usage("cardnumber is mandatory") unless $cardnumber;
45	}	45	}
46		46
47	unless ($password) {
48	my $generator = String::Random->new( rand_gen => \&alt_rand );
49	$password = $generator->randregex('[A-Za-z][A-Za-z0-9_]{6}.[A-Za-z][A-Za-z0-9_]{6}\d');
50	}
51
52	my $filter;	47	my $filter;
53		48
54	if ( $userid ) {	49	if ( $userid ) {
Lines 70-75 unless ( $patrons->count > 0 ) { Link Here
70	}	65	}
71		66
72	my $patron = $patrons->next;	67	my $patron = $patrons->next;
		68
		69	unless ($password) {
		70	my $generator = String::Random->new( rand_gen => \&alt_rand );
		71	my $n = $patron->category->effective_min_password_length;
		72	$n = $n<6?6:$n;
		73	$password = $generator->randregex('[A-Za-z][A-Za-z0-9_]{6}.[A-Za-z][A-Za-z0-9_]{'.$n.'}\d');
		74	}
		75
73	$patron->set_password({ password => $password, skip_validation => 1 });	76	$patron->set_password({ password => $password, skip_validation => 1 });
74		77
75	print $patron->userid . " " . $password . "\n";	78	print $patron->userid . " " . $password . "\n";

Lines 42-48 use Koha::Patron::Attributes; Link Here

(-)a/opac/opac-memberentry.pl (-4 / +4 lines)
42	use Koha::Patron::Images;	42	use Koha::Patron::Images;
43	use Koha::Patron::Modification;	43	use Koha::Patron::Modification;
44	use Koha::Patron::Modifications;	44	use Koha::Patron::Modifications;
45	use Koha::Patrons;	45	use Koha::Patron::Categories;
46	use Koha::Token;	46	use Koha::Token;
47		47
48	my $cgi = new CGI;	48	my $cgi = new CGI;
Lines 178-184 if ( $action eq 'create' ) { Link Here
178	$verification_token = md5_hex( time().{}.rand().{}.$$ );	178	$verification_token = md5_hex( time().{}.rand().{}.$$ );
179	}	179	}
180		180
181	$borrower{password} = Koha::AuthUtils::generate_password unless $borrower{password};	181	$borrower{password} = Koha::AuthUtils::generate_password(Koha::Patron::Categories->find($borrower{categorycode})) unless $borrower{password};
182	$borrower{verification_token} = $verification_token;	182	$borrower{verification_token} = $verification_token;
183		183
184	Koha::Patron::Modification->new( \%borrower )->store();	184	Koha::Patron::Modification->new( \%borrower )->store();
Lines 217-223 if ( $action eq 'create' ) { Link Here
217	);	217	);
218		218
219	$borrower{categorycode} \|\|= C4::Context->preference('PatronSelfRegistrationDefaultCategory');	219	$borrower{categorycode} \|\|= C4::Context->preference('PatronSelfRegistrationDefaultCategory');
220	$borrower{password} \|\|= Koha::AuthUtils::generate_password;	220	$borrower{password} \|\|= Koha::AuthUtils::generate_password(Koha::Patron::Categories->find($borrower{categorycode}));
221	my $consent_dt = delete $borrower{gdpr_proc_consent};	221	my $consent_dt = delete $borrower{gdpr_proc_consent};
222	my $patron = Koha::Patron->new( \%borrower )->store;	222	my $patron = Koha::Patron->new( \%borrower )->store;
223	Koha::Patron::Consent->new({ borrowernumber => $patron->borrowernumber, type => 'GDPR_PROCESSING', given_on => $consent_dt })->store if $consent_dt;	223	Koha::Patron::Consent->new({ borrowernumber => $patron->borrowernumber, type => 'GDPR_PROCESSING', given_on => $consent_dt })->store if $consent_dt;
Lines 476-482 sub CheckForInvalidFields { Link Here
476	push( @invalidFields, "password_match" );	476	push( @invalidFields, "password_match" );
477	}	477	}
478	if ( $borrower->{'password'} ) {	478	if ( $borrower->{'password'} ) {
479	my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $borrower->{password} );	479	my ( $is_valid, $error ) = Koha::AuthUtils::is_password_valid( $borrower->{password}, Koha::Patron::Categories->find($borrower->{categorycode}) );
480	unless ( $is_valid ) {	480	unless ( $is_valid ) {
481	push @invalidFields, 'password_too_short' if $error eq 'too_short';	481	push @invalidFields, 'password_too_short' if $error eq 'too_short';
482	push @invalidFields, 'password_too_weak' if $error eq 'too_weak';	482	push @invalidFields, 'password_too_weak' if $error eq 'too_weak';