[#11798] - Password Options ignored when autocreating a password
- Closed
- 9 Dec 2016
- Medium
- Build: master
- # 11798
Steps to reproduce the issue
In the admin go to the users options and the passwords tab. Set some options such as 5 symbols, 6 digits and 7 uppercase characters
Try to create a user in the admin or front end with a simple password such as 123456 and you can not because of the options that you set.
Now in the admin create a new user but do NOT create a password. This should create the user and email the username and password to the user
Expected result
Password generated in the email will conform to the settings in the user component options
Actual result
Random 9 character password
Votes
| Category | ⇒ | Authentication |
| Status | New | ⇒ | Confirmed |
- I have follow above steps, auto generated password is not working as per admin settings.
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11798.
Hmm maybe we should enable PW reset automagic if we generate a PW as well as generate a 32 char random passwort?
| Labels |
Added:
?
|
||
yes, never noticed this before. But I agree with Brian.
If you setup a password policy in the backend, it must be respected if you choose to generate automatically password.
It's not so easy to do that because the random passwords are coming in by way of random_bytes() (and appropriate PHP 5 backports). It's somewhat hard to create random strings with certain guidelines when you don't have full control over the randomizing functions.
uhm... and what about disabling the automatic password generator when a different policy for password has been configured?
it never uses the config. it is just a random string.
Long and short, if you've got a password policy enabled, unless you grab a massively large block of data from random_bytes() and keep appending characters to the string until you match policy, it's not viable to use random_bytes() as a password generator that has to be policy aware.
Which means changing how the user record is handled in that case. Do you allow NULL passwords or do you cause form validation errors (which prevents saving) on an empty value?
So long and farewell
| Status | Confirmed | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-12-09 15:34:59 |
| Closed_By | ⇒ | brianteeman |
I have follow above steps and able to reproduce this issue. Auto generated password is not as per my settings.
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11798.