Bug 9920

Summary: Set minPasswordLength to a higher value by default
Product: Koha Reporter: Peter Kelly <peterAtKohaBugzilla>
Component: PatronsAssignee: Peter Kelly <peterAtKohaBugzilla>
Status: RESOLVED DUPLICATE QA Contact:
Severity: enhancement    
Priority: P5 - low CC: aleisha, gmcharlt, jonathan.druart, josef.moravec, katrin.fischer, kyle.m.hall, m.de.rooy, magnus, peterAtKohaBugzilla
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18298
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Patch to increase password length

Description Peter Kelly 2013-03-25 04:29:14 UTC
On the koha/members/member-password.pl I asked it to suggest a password, and it suggested one with four characters.  For the reasons discussed in bug 9885, that seems too few.  The suggestion accepted there was twelve characters.
Comment 1 Magnus Enger 2013-03-25 08:47:39 UTC
As far as I can tell, the password being generated by Koha respcts the minPasswordLength syspref, so libraries that want better security can just set this syspref to a high number. But perhaps it would be a good idea to set the default for minPasswordLength higher than 4?
Comment 2 Marcel de Rooy 2013-03-25 09:08:16 UTC
(In reply to comment #1)
> As far as I can tell, the password being generated by Koha respcts the
> minPasswordLength syspref, so libraries that want better security can just
> set this syspref to a high number. But perhaps it would be a good idea to
> set the default for minPasswordLength higher than 4?

+1 for a higher default, but 12 may be a problem in terms of usability?
Not mentioning passwords submitted over http :)
Comment 3 Peter Kelly 2014-11-02 19:57:33 UTC
Created attachment 33134 [details] [review]
Patch to increase password length
Comment 4 Peter Kelly 2014-11-02 19:58:35 UTC
To be honest, I haven't tested this patch.  But it is so simple, "what could possibly go wrong".  I don't have time to test it right now so am uploading it but leaving the status unchanged.
Comment 5 Peter Kelly 2014-11-02 22:21:02 UTC
Sorry, I should have said - the patch increases the default length to 12.  The default length was discussed in bug 9885.
Comment 6 Aleisha Amohia 2015-04-28 02:50:09 UTC
Setting to Needs Signoff as it looks like this is ready to be tested by someone
Comment 7 Marcel de Rooy 2015-04-28 06:09:51 UTC
This patch changes db rev 3.00.00.031.
It should add a new db rev.
Comment 8 Jonathan Druart 2017-10-23 15:03:28 UTC

*** This bug has been marked as a duplicate of bug 18308 ***