Pull Request resolves #48395.

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Improves accessibility of the "Set the password for your Super User account" field during Joomla installation and other areas of the interface that have a password-strength requirement. Screen reader users now receive the password length requirement and their progress while typing, such as “10 out of 12 characters entered.”. Previously, all that was conveyed was: "Password does not meet the site's requirements" without any further explanation or context, even though the password meter visually indicated the user's progress to entering a sufficient password. Additionally, language strings were added so that the status messages are translated as necessary dependent upon installation language.

Note that this is a targeted fix for password strength on the installer page, but if there are other forms using the shared password-strength script, they should be reviewed also to ensure no regressions have been introduced.

The new behaviour is as such:

1. Focusing the field conveys that 12 characters are required for the password by means of the description associated with the field.
2. Entering one character then ceasing typing results in "Password does not meet the site's requirements. Enter at least 12 characters. 1 out of 12 characters entered."
3. Characters 2–11 result in "Enter at least 12 characters. x out of 12 characters entered." where x represents the number of characters.
4. Password completion is conveyed as "Password accepted"
5. Deletion of a single character from the 12 character password results in: "Password does not meet the site's requirements. Enter at least 12 characters. 11 out of 12 characters entered."
6. Deletion of more characters results in "Enter at least 12 characters. x out of 12 characters entered." where x represents the number of characters.
7. Deletion to zero characters results in no announcement.

Below is an image containing the speech output from NVDA that shows what the interaction is conveyed as verbally:

Testing Instructions

This a complex interaction and requires a screen reader and many steps in 3 phases. (NVDA, VoiceOver, and Narrator are suggested.)

Phase 1

1. Start a new Joomla installation with this PR applied.
2. Once installed, enable a screen reader and proceed past the first step of installation (Name of your site) to the Super User account setup
3. Navigate to the "Set the password for your Super User account" field. Confirm that the password-length requirement is announced.
4. Enter one character and stop typing. Listen for the announcement. It should be "Password doesn't meet the site's requirements. Enter at least 12 characters. 1 out of 12 characters entered."
5. Enter fewer than 12 characters. Note that the “Password doesn't meet the site's requirements” was only announced once. Now the announcement is "Enter at least 12 characters. x out of 12 characters entered." where x represents the number of characters.
6. Continue typing until 11 characters and stop. The message conveyed should be: “Enter at least 12 characters. 11 out of 12 characters entered.”
7. Continue typing until the password reaches 12 characters. Confirm that the completion message is announced.
8. Delete one character to bring the number to 11. The announcement should be: "Password doesn't meet the site's requirements. Enter at least 12 characters. 11 out of 12 characters entered."
9. Delete characters to bring the password below 12. Confirm that the requirement and progress feedback return.
10. Stop typing. Confirm that announcements do not keep repeating.
11. Confirm that the password requirement is not duplicated visually.
12. Confirm that an insufficient password still prevents you from continuing.

Phase 2

1. Complete the Joomla installation and continue to another field that has a password strength feature, such as Users > Manage > [username] > Password
2. Ensure the same behaviour as mentioned with the Installer > Super User password field from Phase 1 is present.

Phase 3

1. Set up custom password requirements within the Users > Manage > Options > Password Options section. (For example, Minimum Numbers set to 3, Minimum Upper Case set to 2.)
2. Save and Close from the custom options and return to the Users > Manage > [username] > Password field
3. Ensure that your custom password options are announced by the screen reader in the same fashion as Phases 1 and 2.
4. Congratulate yourself for completing this testing regimen.

The following image depicts speech output from NVDA when encountering a custom password field set up by the site admin. Note that the output matches the password description exactly.

I have tested this with NVDA and Narrator in Chrome, Edge, and Firefox.

Actual result BEFORE applying this Pull Request

The password length requirement is announced when entering the field when there is no input in it, but it is not included in the feedback while typing. Users hear that their password does not meet the requirements without being reminded of the required length or their progress.

Expected result AFTER applying this Pull Request

Screen reader users hear the requirement and their progress while typing. The incomplete password message is not repeated with every update. The existing instructions are not duplicated visually, and password validation continues to work. A more robust experience for screen reader users is achieved.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed