From a4a6a3da4d0e475571a2d994628607b198c39677 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 16 Mar 2017 23:01:34 -0300 Subject: [PATCH] Bug 18298: minPaswordLength should not be < 3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Indeed if RequireStrongPassword is set we need at least 3 characters to match 1 upper, 1 lower and 1 digit. We could make things more complicated to allow minPasswordLength < 3 but, really, 3 is already too low... Signed-off-by: Marc VĂ©ron --- C4/Auth.pm | 3 +++ .../prog/en/modules/members/memberentrygen.tt | 2 +- .../opac-tmpl/bootstrap/en/modules/opac-memberentry.tt | 14 +++++--------- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt | 4 ++-- members/member-password.pl | 2 +- members/memberentry.pl | 5 ++--- opac/opac-memberentry.pl | 1 + opac/opac-passwd.pl | 2 +- opac/opac-password-recovery.pl | 5 ++--- 9 files changed, 18 insertions(+), 20 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 5dcf1cd..2a6ddb3 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -413,6 +413,8 @@ sub get_template_and_user { my $https = $in->{query}->https(); my $using_https = ( defined $https and $https ne 'OFF' ) ? 1 : 0; + my $minPasswordLength = C4::Context->preference('minPasswordLength'); + $minPasswordLength = 3 if not $minPasswordLength or $minPasswordLength < 3; $template->param( "BiblioDefaultView" . C4::Context->preference("BiblioDefaultView") => 1, EnhancedMessagingPreferences => C4::Context->preference('EnhancedMessagingPreferences'), @@ -434,6 +436,7 @@ sub get_template_and_user { noItemTypeImages => C4::Context->preference("noItemTypeImages"), marcflavour => C4::Context->preference("marcflavour"), OPACBaseURL => C4::Context->preference('OPACBaseURL'), + minPasswordLength => $minPasswordLength, ); if ( $in->{'type'} eq "intranet" ) { $template->param( diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt index 740786f..cb902bf 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt @@ -888,7 +888,7 @@ $(document).ready(function() { [% END %] [% END %] [% IF ( mandatorypassword ) %]Required[% END %][% IF ( ERROR_short_password ) %]Password is too short[% END %] -[% IF ( minPasswordLength ) %]
Minimum password length: [% minPasswordLength %]
[% END %] +
Minimum password length: [% minPasswordLength %]
  • [% IF ( mandatorypassword ) %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt index aed00ed..281f59c 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt @@ -850,16 +850,12 @@ [% UNLESS action == 'edit' || hidden.defined('password') %]
    Password - [% IF Koha.Preference('minPasswordLength') || !mandatory.defined('password') %] -
    - [% IF Koha.Preference('minPasswordLength') %] -

    Your password must be at least [% Koha.Preference('minPasswordLength') %] characters long.

    - [% END %] - [% UNLESS mandatory.defined('password') %] - If you do not enter a password a system generated password will be created. - [% END %] +
    +

    Your password must be at least [% Koha.Preference('minPasswordLength') %] characters long.

    + [% UNLESS mandatory.defined('password') %] + If you do not enter a password a system generated password will be created. + [% END %]
    - [% END %] [% IF mandatory.defined('password') %]
      diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt index baa083b..307f71d 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt @@ -33,7 +33,7 @@ Passwords do not match. Please re-type your new password. [% END %] [% IF ( ShortPass ) %] - Your new password must be at least [% minpasslen %] characters long. + Your new password must be at least [% minPasswordLength%] characters long. [% END %] [% IF ( WrongPass ) %] Your current password was entered incorrectly. If this problem persists, please ask a librarian to reset your password for you. @@ -50,7 +50,7 @@
      - [% UNLESS ( ShortPass ) %]
      Your password must be at least [% minpasslen %] characters long.
      [% END %] + [% UNLESS ( ShortPass ) %]
      Your password must be at least [% minPasswordLength%] characters long.
      [% END %] diff --git a/members/member-password.pl b/members/member-password.pl index 2ce00a7..815857a 100755 --- a/members/member-password.pl +++ b/members/member-password.pl @@ -63,6 +63,7 @@ if ( ( $member ne $loggedinuser ) && ( $bor->{'category_type'} eq 'S' ) ) { push( @errors, 'NOMATCH' ) if ( ( $newpassword && $newpassword2 ) && ( $newpassword ne $newpassword2 ) ); my $minpw = C4::Context->preference('minPasswordLength'); +$minpw = 3 if not $minpw or $minpw < 3; push( @errors, 'SHORTPASSWORD' ) if ( $newpassword && $minpw && ( length($newpassword) < $minpw ) ); if ( $newpassword && !scalar(@errors) ) { @@ -136,7 +137,6 @@ $template->param( destination => $destination, is_child => ( $bor->{'category_type'} eq 'C' ), activeBorrowerRelationship => ( C4::Context->preference('borrowerRelationship') ne '' ), - minPasswordLength => $minpw, RoutingSerials => C4::Context->preference('RoutingSerials'), csrf_token => Koha::Token->new->generate_csrf({ id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ), diff --git a/members/memberentry.pl b/members/memberentry.pl index ef0aa90..cc5c4bc 100755 --- a/members/memberentry.pl +++ b/members/memberentry.pl @@ -134,9 +134,6 @@ if ( $input->param('add_debarment') ) { $template->param("uppercasesurnames" => C4::Context->preference('uppercasesurnames')); -my $minpw = C4::Context->preference('minPasswordLength'); -$template->param("minPasswordLength" => $minpw); - # function to designate mandatory fields (visually with css) my $check_BorrowerMandatoryField=C4::Context->preference("BorrowerMandatoryField"); my @field_check=split(/\|/,$check_BorrowerMandatoryField); @@ -350,6 +347,8 @@ if ($op eq 'save' || $op eq 'insert'){ my $password = $input->param('password'); my $password2 = $input->param('password2'); push @errors, "ERROR_password_mismatch" if ( $password ne $password2 ); + my $minpw = C4::Context->preference('minPasswordLength'); + $minpw = 3 if not $minpw or $minpw < 3; push @errors, "ERROR_short_password" if( $password && $minpw && $password ne '****' && (length($password) < $minpw) ); # Validate emails diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl index c1610a1..f689ab5 100755 --- a/opac/opac-memberentry.pl +++ b/opac/opac-memberentry.pl @@ -366,6 +366,7 @@ sub CheckMandatoryFields { sub CheckForInvalidFields { my $minpw = C4::Context->preference('minPasswordLength'); + $minpw = 3 if not $minpw or $minpw < 3; my $borrower = shift; my @invalidFields; if ($borrower->{'email'}) { diff --git a/opac/opac-passwd.pl b/opac/opac-passwd.pl index 4b33413..8096727 100755 --- a/opac/opac-passwd.pl +++ b/opac/opac-passwd.pl @@ -46,6 +46,7 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( my $borr = C4::Members::GetMember( borrowernumber => $borrowernumber ); my $minpasslen = C4::Context->preference("minPasswordLength"); +$minpasslen = 3 if not $minpasslen or $minpasslen < 3; if ( C4::Context->preference("OpacPasswordChange") ) { my $sth = $dbh->prepare("UPDATE borrowers SET password = ? WHERE borrowernumber=?"); if ( $query->param('Oldkey') @@ -105,7 +106,6 @@ if ( C4::Context->preference("OpacPasswordChange") ) { } $template->param(firstname => $borr->{'firstname'}, surname => $borr->{'surname'}, - minpasslen => $minpasslen, passwdview => 1, ); diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl index 8c76015..c4c662c 100755 --- a/opac/opac-password-recovery.pl +++ b/opac/opac-password-recovery.pl @@ -28,7 +28,6 @@ my ( $template, $dummy, $cookie ) = get_template_and_user( my $email = $query->param('email') // q{}; my $password = $query->param('password'); my $repeatPassword = $query->param('repeatPassword'); -my $minPassLength = C4::Context->preference('minPasswordLength'); my $id = $query->param('id'); my $uniqueKey = $query->param('uniqueKey'); my $username = $query->param('username'); @@ -133,6 +132,8 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { elsif ( $query->param('passwordReset') ) { ( $borrower_number, $username ) = GetValidLinkInfo($uniqueKey); + my $minPassLength = C4::Context->preference('minPasswordLength'); + $minPassLength = 3 if not $minPassLength or $minPassLength < 3; #validate password length & match if ( ($borrower_number) && ( $password eq $repeatPassword ) @@ -157,7 +158,6 @@ elsif ( $query->param('passwordReset') ) { } $template->param( new_password => 1, - minPassLength => $minPassLength, email => $email, uniqueKey => $uniqueKey, errLinkNotValid => $errLinkNotValid, @@ -177,7 +177,6 @@ elsif ($uniqueKey) { #reset password form $template->param( new_password => 1, - minPassLength => $minPassLength, email => $email, uniqueKey => $uniqueKey, username => $username, -- 2.1.4