Bug 30605

Summary: New password should be more than just unequal to old password
Product: Koha Reporter: Marcel de Rooy <m.de.rooy>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dpavlin, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29925
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32553
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Marcel de Rooy 2022-04-25 12:01:39 UTC
From a comment on bug 29925:

If my password was 123Jim+1, and I just change to 123Jim+2, or change 3Jim@abc to 4Jim@abc, could we refuse such changes?
Look for some 'large enough' string that they have in common or so?
Or compare the number of positions where they are different?

Note that it might be possible to move such code into a check_password plugin, but we would need the old and new password when calling ->set_password.
Comment 1 Owen Leonard 2022-04-25 12:16:40 UTC
I hope this change can be made optional.