Bug 9920 - Set minPasswordLength to a higher value by default
Summary: Set minPasswordLength to a higher value by default
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-03-25 04:29 UTC by Peter Kelly
Modified: 2017-09-06 14:53 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Patch to increase password length (3.28 KB, patch)
2014-11-02 19:57 UTC, Peter Kelly
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Kelly 2013-03-25 04:29:14 UTC
On the koha/members/member-password.pl I asked it to suggest a password, and it suggested one with four characters.  For the reasons discussed in bug 9885, that seems too few.  The suggestion accepted there was twelve characters.
Comment 1 Magnus Enger 2013-03-25 08:47:39 UTC
As far as I can tell, the password being generated by Koha respcts the minPasswordLength syspref, so libraries that want better security can just set this syspref to a high number. But perhaps it would be a good idea to set the default for minPasswordLength higher than 4?
Comment 2 Marcel de Rooy 2013-03-25 09:08:16 UTC
(In reply to comment #1)
> As far as I can tell, the password being generated by Koha respcts the
> minPasswordLength syspref, so libraries that want better security can just
> set this syspref to a high number. But perhaps it would be a good idea to
> set the default for minPasswordLength higher than 4?

+1 for a higher default, but 12 may be a problem in terms of usability?
Not mentioning passwords submitted over http :)
Comment 3 Peter Kelly 2014-11-02 19:57:33 UTC
Created attachment 33134 [details] [review]
Patch to increase password length
Comment 4 Peter Kelly 2014-11-02 19:58:35 UTC
To be honest, I haven't tested this patch.  But it is so simple, "what could possibly go wrong".  I don't have time to test it right now so am uploading it but leaving the status unchanged.
Comment 5 Peter Kelly 2014-11-02 22:21:02 UTC
Sorry, I should have said - the patch increases the default length to 12.  The default length was discussed in bug 9885.
Comment 6 Aleisha Amohia 2015-04-28 02:50:09 UTC
Setting to Needs Signoff as it looks like this is ready to be tested by someone
Comment 7 Marcel de Rooy 2015-04-28 06:09:51 UTC
This patch changes db rev 3.00.00.031.
It should add a new db rev.