Add password complexity checks for openhab-cloud account #80
Conversation
All places, where a password can be set will now go through a new class, UserPassword, which will check the password complexity before setting the password to the user account. It also provides a check method to check the complexity requirements before a user account will be created. If the complexity rules aren't met, the save of the password will be denied and an error message with the complexity rules is shown. Fixes openhab#75
|
@FlorianSW, |
|
Hi @FlorianSW this works well when changing a password, but we also let users choose a password when they create an account and I don't think this is getting used there? |
| @@ -343,6 +354,12 @@ exports.registerpost = function(req, res) { | |||
| res.render('login', { title: "Login / Sign up", user: req.user, | |||
| errormessages:req.flash('error'), infomessages:req.flash('info') }); | |||
| } else { | |||
| if (!UserPassword.isComplexEnough(req.body.password)) { | |||
There was a problem hiding this comment.
This should be the place where a user selected a password during registration, isn't it?
|
Hi @digitaldan :) Thanks for your review! It's totally possible, that I missed a place, however, see my comment, where I think the registration password should be handled? Do I miss another place, too? Thanks for your help :) |
|
It looks like it, but for some reason it let me create an account with 1234 as my password, let me try again and make sure my password manager didn't autofill something in right before i hit submit (lastpass does that sometimes). |
|
Interesting, I checked this, too (I remember that, because I already wrote git push and remembered, that I forgot to change behaviour of the register form and I had to implement that before I pushed :P). I'll check that again, just to be sure :) |
|
I just tried it again and now it works, I'm going to blame lastpass :-) |
|
I tested it again, too, and it's working great yeah Thanks for merging! |
|
@FlorianSW looks good! |
All places, where a password can be set will now go through a new class,
UserPassword, which will check the password complexity before setting the
password to the user account. It also provides a check method to check the
complexity requirements before a user account will be created. If the
complexity rules aren't met, the save of the password will be denied and an
error message with the complexity rules is shown.
Fixes #75