Project

General

Profile

Actions

Feature #37279

open

Reject passwords that are the same as login, first name, last name, or email

Added by Go MAEDA almost 2 years ago. Updated about 24 hours ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Accounts / authentication
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed

Description

Some lazy users may use their login IDs or their names as passwords. This can be a security threat.

Such passwords should always be rejected.


Files

37279.patch (2.33 KB) 37279.patch Go MAEDA, 2022-07-09 09:14
Actions #2

Updated by Go MAEDA almost 2 years ago

  • File 37279.patch added

The attached patch adds User#test_validate_password_complexity. It rejects passwords that are the same as the user's login, first name, last name, or email for now. I think it would be great if the method is extended to also reject passwords with dictionary words in the future.

Actions #3

Updated by Go MAEDA almost 2 years ago

  • File deleted (37279.patch)
Actions #4

Updated by Go MAEDA almost 2 years ago

Actions #5

Updated by Go MAEDA 27 days ago

  • Subject changed from Reject passwords that are the same as login, first name, or last name to Reject passwords that are the same as login, first name, last name, or email
  • Target version set to 6.0.0

Setting the target version to 6.0.0.

Actions #6

Updated by Go MAEDA about 24 hours ago

  • Status changed from New to Resolved
  • Assignee set to Go MAEDA
  • Resolution set to Fixed

Committed the patch in r22888.

Actions

Also available in: Atom PDF