Bug 13664 - Add password strength plugin
Summary: Add password strength plugin
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: David Roberts
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-02-03 18:41 UTC by David Roberts
Modified: 2017-06-13 14:38 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Add jquery-complexify library (7.69 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Added complexify display to opac-passwd page (3.70 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Change formatting and correct spelling mistakes (2.04 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add OPACPasswordStrength syspref to staff client (1.20 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add SQL for OPACPasswordStrength syspref (1.37 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add default OPACPasswordStrength syspref to updatedatabase.pl (1.13 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add OPACPasswordStrength System Preference to Auth.pm (1.17 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Put password meter under syspref control (2.38 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add password strength meter to staff client (2.19 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add jquery plugins to staff client (7.10 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add complexify includes file to staff client (952 bytes, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add new PasswordStrength syspref (2.35 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add code to updatedatabase.pl (1.11 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Put staff client password strength meter under syspref control (2.16 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add password strength meter to add and duplicate user in staff client (2.47 KB, patch)
2015-05-05 15:57 UTC, David Roberts
Details | Diff | Splinter Review
Add password strength meter to add and duplicate user in staff client (2.53 KB, patch)
2015-05-20 08:56 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add jquery-complexify library (7.73 KB, patch)
2015-05-20 09:05 UTC, tadeas.moravec
Details | Diff | Splinter Review
Added complexify display to opac-passwd page (3.75 KB, patch)
2015-05-20 09:05 UTC, tadeas.moravec
Details | Diff | Splinter Review
Change formatting and correct spelling mistakes (2.08 KB, patch)
2015-05-20 09:05 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add OPACPasswordStrength syspref to staff client (1.25 KB, patch)
2015-05-20 09:05 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add SQL for OPACPasswordStrength syspref (1.42 KB, patch)
2015-05-20 09:05 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add default OPACPasswordStrength syspref to updatedatabase.pl (1.12 KB, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add OPACPasswordStrength System Preference to Auth.pm (1.21 KB, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Put password meter under syspref control (2.42 KB, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add password strength meter to staff client (2.22 KB, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add jquery plugins to staff client (7.15 KB, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add complexify includes file to staff client (997 bytes, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add new PasswordStrength syspref (2.40 KB, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add code to updatedatabase.pl (1.16 KB, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Put staff client password strength meter under syspref control (2.20 KB, patch)
2015-05-20 09:06 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add password strength meter to add and duplicate user in staff client (2.58 KB, patch)
2015-05-20 09:07 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add password strength to member-password screen (2.14 KB, patch)
2015-05-26 21:10 UTC, David Roberts
Details | Diff | Splinter Review
Add jquery-complexify library (7.78 KB, patch)
2015-05-27 05:52 UTC, tadeas.moravec
Details | Diff | Splinter Review
Added complexify display to opac-passwd page (3.80 KB, patch)
2015-05-27 05:52 UTC, tadeas.moravec
Details | Diff | Splinter Review
Change formatting and correct spelling mistakes (2.13 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add OPACPasswordStrength syspref to staff client (1.30 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add SQL for OPACPasswordStrength syspref (1.47 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add default OPACPasswordStrength syspref to updatedatabase.pl (1.17 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add OPACPasswordStrength System Preference to Auth.pm (1.26 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Put password meter under syspref control (2.47 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add password strength meter to staff client (2.27 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add jquery plugins to staff client (7.20 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add complexify includes file to staff client (1.02 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add new PasswordStrength syspref (2.45 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add code to updatedatabase.pl (1.21 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Put staff client password strength meter under syspref control (2.25 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add password strength meter to add and duplicate user in staff client (2.63 KB, patch)
2015-05-27 05:53 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add password strength to member-password screen (2.19 KB, patch)
2015-05-27 05:54 UTC, tadeas.moravec
Details | Diff | Splinter Review
Add jquery-complexify library (7.69 KB, patch)
2015-05-27 16:31 UTC, David Roberts
Details | Diff | Splinter Review
Added complexify display to opac-passwd page (3.70 KB, patch)
2015-05-27 16:31 UTC, David Roberts
Details | Diff | Splinter Review
Change formatting and correct spelling mistakes (2.04 KB, patch)
2015-05-27 16:31 UTC, David Roberts
Details | Diff | Splinter Review
Add OPACPasswordStrength syspref to staff client (1.20 KB, patch)
2015-05-27 16:31 UTC, David Roberts
Details | Diff | Splinter Review
Add SQL for OPACPasswordStrength syspref (1.37 KB, patch)
2015-05-27 16:31 UTC, David Roberts
Details | Diff | Splinter Review
Add default OPACPasswordStrength syspref to updatedatabase.pl (1.07 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Add OPACPasswordStrength System Preference to Auth.pm (1.17 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Put password meter under syspref control (2.38 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Add password strength meter to staff client (2.18 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Add jquery plugins to staff client (7.10 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Add complexify includes file to staff client (952 bytes, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Add new PasswordStrength syspref (2.35 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Add code to updatedatabase.pl (1.11 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Put staff client password strength meter under syspref control (2.16 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Add password strength meter to add and duplicate user in staff client (2.46 KB, patch)
2015-05-27 16:32 UTC, David Roberts
Details | Diff | Splinter Review
Add password strength to member-password screen (2.14 KB, patch)
2015-05-27 16:33 UTC, David Roberts
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Roberts 2015-02-03 18:41:22 UTC
Add password strength plugin using complexify. This should be linked to system preferences, and apply to both staff and public logins.
Comment 1 David Roberts 2015-05-05 15:57:03 UTC Comment hidden (obsolete)
Comment 2 David Roberts 2015-05-05 15:57:05 UTC Comment hidden (obsolete)
Comment 3 David Roberts 2015-05-05 15:57:08 UTC Comment hidden (obsolete)
Comment 4 David Roberts 2015-05-05 15:57:10 UTC Comment hidden (obsolete)
Comment 5 David Roberts 2015-05-05 15:57:12 UTC Comment hidden (obsolete)
Comment 6 David Roberts 2015-05-05 15:57:14 UTC Comment hidden (obsolete)
Comment 7 David Roberts 2015-05-05 15:57:16 UTC Comment hidden (obsolete)
Comment 8 David Roberts 2015-05-05 15:57:19 UTC Comment hidden (obsolete)
Comment 9 David Roberts 2015-05-05 15:57:21 UTC Comment hidden (obsolete)
Comment 10 David Roberts 2015-05-05 15:57:23 UTC Comment hidden (obsolete)
Comment 11 David Roberts 2015-05-05 15:57:25 UTC Comment hidden (obsolete)
Comment 12 David Roberts 2015-05-05 15:57:27 UTC Comment hidden (obsolete)
Comment 13 David Roberts 2015-05-05 15:57:29 UTC Comment hidden (obsolete)
Comment 14 David Roberts 2015-05-05 15:57:32 UTC Comment hidden (obsolete)
Comment 15 David Roberts 2015-05-05 15:57:34 UTC Comment hidden (obsolete)
Comment 16 David Roberts 2015-05-05 16:09:27 UTC
To Test:

This patch adds two new system preferences: PasswordStrength which works in the staff client, and OPACPasswordStrength which controls the OPAC.

1) Install patches
2) Enable both system preferences.
3) Log into the OPAC
4) Go to "Change your Password"
5) Type a new password into the new password field - the meter should indicate how strong the password is based on the length of the password and whether or not any part of the password appears in a ban list of some 500 bad passwords (e.g. qwerty, password, 1234 etc)

6) Log into the staff client
7) Create a new patron - the meter should display next to the password field.
8) Check that it also displays when editing or duplicating a patron.

Check that typing into the field moves the meter appropriately, and that you are still able to save passwords / edits to the user record when this system preference is enabled.
Comment 17 tadeas.moravec 2015-05-20 08:56:53 UTC Comment hidden (obsolete)
Comment 18 tadeas.moravec 2015-05-20 09:05:14 UTC Comment hidden (obsolete)
Comment 19 tadeas.moravec 2015-05-20 09:05:29 UTC Comment hidden (obsolete)
Comment 20 tadeas.moravec 2015-05-20 09:05:35 UTC Comment hidden (obsolete)
Comment 21 tadeas.moravec 2015-05-20 09:05:49 UTC Comment hidden (obsolete)
Comment 22 tadeas.moravec 2015-05-20 09:05:55 UTC Comment hidden (obsolete)
Comment 23 tadeas.moravec 2015-05-20 09:06:02 UTC Comment hidden (obsolete)
Comment 24 tadeas.moravec 2015-05-20 09:06:14 UTC Comment hidden (obsolete)
Comment 25 tadeas.moravec 2015-05-20 09:06:19 UTC Comment hidden (obsolete)
Comment 26 tadeas.moravec 2015-05-20 09:06:24 UTC Comment hidden (obsolete)
Comment 27 tadeas.moravec 2015-05-20 09:06:31 UTC Comment hidden (obsolete)
Comment 28 tadeas.moravec 2015-05-20 09:06:36 UTC Comment hidden (obsolete)
Comment 29 tadeas.moravec 2015-05-20 09:06:44 UTC Comment hidden (obsolete)
Comment 30 tadeas.moravec 2015-05-20 09:06:50 UTC Comment hidden (obsolete)
Comment 31 tadeas.moravec 2015-05-20 09:06:55 UTC Comment hidden (obsolete)
Comment 32 tadeas.moravec 2015-05-20 09:07:01 UTC Comment hidden (obsolete)
Comment 33 Kyle M Hall 2015-05-22 14:18:09 UTC
I don't see the strength indicator on members/member-password.pl

Can you please add it there as well?
Comment 34 David Roberts 2015-05-26 21:10:34 UTC Comment hidden (obsolete)
Comment 35 David Roberts 2015-05-26 21:12:02 UTC
Good spot - I've now added it to that screen. Changing status back to needing sign-off. Test plan remains the same, but including the Change Password feature in the staff client.
Comment 36 tadeas.moravec 2015-05-27 05:52:54 UTC Comment hidden (obsolete)
Comment 37 tadeas.moravec 2015-05-27 05:52:58 UTC Comment hidden (obsolete)
Comment 38 tadeas.moravec 2015-05-27 05:53:03 UTC Comment hidden (obsolete)
Comment 39 tadeas.moravec 2015-05-27 05:53:08 UTC Comment hidden (obsolete)
Comment 40 tadeas.moravec 2015-05-27 05:53:13 UTC Comment hidden (obsolete)
Comment 41 tadeas.moravec 2015-05-27 05:53:18 UTC Comment hidden (obsolete)
Comment 42 tadeas.moravec 2015-05-27 05:53:22 UTC Comment hidden (obsolete)
Comment 43 tadeas.moravec 2015-05-27 05:53:27 UTC Comment hidden (obsolete)
Comment 44 tadeas.moravec 2015-05-27 05:53:31 UTC Comment hidden (obsolete)
Comment 45 tadeas.moravec 2015-05-27 05:53:36 UTC Comment hidden (obsolete)
Comment 46 tadeas.moravec 2015-05-27 05:53:41 UTC Comment hidden (obsolete)
Comment 47 tadeas.moravec 2015-05-27 05:53:46 UTC Comment hidden (obsolete)
Comment 48 tadeas.moravec 2015-05-27 05:53:50 UTC Comment hidden (obsolete)
Comment 49 tadeas.moravec 2015-05-27 05:53:55 UTC Comment hidden (obsolete)
Comment 50 tadeas.moravec 2015-05-27 05:53:59 UTC Comment hidden (obsolete)
Comment 51 tadeas.moravec 2015-05-27 05:54:04 UTC Comment hidden (obsolete)
Comment 52 Jonathan Druart 2015-05-27 15:16:24 UTC
Applying: Put staff client password strength meter under syspref control
fatal: sha1 information is lacking or useless (C4/Auth.pm).
Repository lacks necessary blobs to fall back on 3-way merge.
Cannot fall back to three-way merge.
Comment 53 David Roberts 2015-05-27 16:31:28 UTC
Created attachment 39594 [details] [review]
Add jquery-complexify library
Comment 54 David Roberts 2015-05-27 16:31:38 UTC
Created attachment 39595 [details] [review]
Added complexify display to opac-passwd page
Comment 55 David Roberts 2015-05-27 16:31:46 UTC
Created attachment 39596 [details] [review]
Change formatting and correct spelling mistakes
Comment 56 David Roberts 2015-05-27 16:31:52 UTC
Created attachment 39597 [details] [review]
Add OPACPasswordStrength syspref to staff client
Comment 57 David Roberts 2015-05-27 16:31:59 UTC
Created attachment 39598 [details] [review]
Add SQL for OPACPasswordStrength syspref
Comment 58 David Roberts 2015-05-27 16:32:05 UTC
Created attachment 39599 [details] [review]
Add default OPACPasswordStrength syspref to updatedatabase.pl
Comment 59 David Roberts 2015-05-27 16:32:10 UTC
Created attachment 39600 [details] [review]
Add OPACPasswordStrength System Preference to Auth.pm
Comment 60 David Roberts 2015-05-27 16:32:15 UTC
Created attachment 39601 [details] [review]
Put password meter under syspref control
Comment 61 David Roberts 2015-05-27 16:32:21 UTC
Created attachment 39602 [details] [review]
Add password strength meter to staff client
Comment 62 David Roberts 2015-05-27 16:32:26 UTC
Created attachment 39603 [details] [review]
Add jquery plugins to staff client
Comment 63 David Roberts 2015-05-27 16:32:32 UTC
Created attachment 39604 [details] [review]
Add complexify includes file to staff client
Comment 64 David Roberts 2015-05-27 16:32:39 UTC
Created attachment 39605 [details] [review]
Add new PasswordStrength syspref
Comment 65 David Roberts 2015-05-27 16:32:44 UTC
Created attachment 39606 [details] [review]
Add code to updatedatabase.pl
Comment 66 David Roberts 2015-05-27 16:32:52 UTC
Created attachment 39607 [details] [review]
Put staff client password strength meter under syspref control
Comment 67 David Roberts 2015-05-27 16:32:59 UTC
Created attachment 39608 [details] [review]
Add password strength meter to add and duplicate user in staff client
Comment 68 David Roberts 2015-05-27 16:33:14 UTC
Created attachment 39609 [details] [review]
Add password strength to member-password screen
Comment 69 David Roberts 2015-05-27 16:35:53 UTC
I've resubmitted the patch, and it seems to apply OK for me now.
Comment 70 Jonathan Druart 2015-06-03 08:11:08 UTC
You can switch the status back to Signed Off after a rebase, unless you are not confident and/or you rewrote a part of the patches to fix the conflict.
Comment 71 David Roberts 2015-06-03 08:30:58 UTC
Ah, I didn't know that. All the patches have been signed off, so I'll change the status. Thanks
Comment 72 Jonathan Druart 2015-06-03 14:15:01 UTC
QA comment:

1/ Really, it's very hard to provide a strong password with this plugin...
Something like "A1!p2@3foo4bar%" only fill half of the gauge.
2/ There is no indication to explain what is the gauge
3/ New lib has to be added to the about page.
4/  FAIL   installer/data/mysql/updatedatabase.pl
   FAIL   forbidden patterns
forbidden pattern: Use INSERT IGNORE INTO on inserting a new syspref (see bug 9071) (line 10532)
forbidden pattern: Use INSERT IGNORE INTO on inserting a new syspref (see bug 9071) (line 10526)
5/ No need to pass the pref value in C4::Auth, use the Koha TT plugin
6/ [% INCLUDE 'complexify.inc' %] should be put in the head part
7/ in members/member-password.tt you include the complexity.inc but also include the jquery.complexify.js from github
8/ The most important: the gauges are not the same at the OPAC and at the intranet.

Marked as Failed QA.
Comment 73 Jonathan Druart 2015-06-03 14:18:41 UTC
Ha yes, something else: 16 patches is much too many for this features :)
Comment 74 Olli-Antti Kivilahti 2017-06-13 11:54:43 UTC
There already is an implementation for this feature.

Bug 12617


I recommend you avoid adding new sysprefs and use borrower category parameters instead. There are way too many sysprefs already. Think on how to remove excess, not add new ones.
See Bug 12617.


The way the patches are split to separate pieces is pretty cool. This would be a great tutorial on how to write code for Koha!

I believe the RM can squash these together when pushing to master.

Personally I cannot find enough integrity to keep the code commits in such small and condensed chunks.
Should be small enough steps for the community small-steps-guideline.
Comment 75 Jonathan Druart 2017-06-13 14:38:04 UTC
(In reply to Olli-Antti Kivilahti from comment #74)

Most of the code from this bug report will be replaced with patches from bug 18298.