Bug 30605 - New password should be more than just unequal to old password
Summary: New password should be more than just unequal to old password
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-04-25 12:01 UTC by Marcel de Rooy
Modified: 2023-06-17 21:18 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2022-04-25 12:01:39 UTC 
From a comment on bug 29925:

If my password was 123Jim+1, and I just change to 123Jim+2, or change 3Jim@abc to 4Jim@abc, could we refuse such changes?
Look for some 'large enough' string that they have in common or so?
Or compare the number of positions where they are different?

Note that it might be possible to move such code into a check_password plugin, but we would need the old and new password when calling ->set_password.
Comment 1 Owen Leonard 2022-04-25 12:16:40 UTC 
I hope this change can be made optional.