Re: How to require stronger passwords for Roundup (1.5.1)

On 31/01/17 12:58, Hancock, David (DHANCOCK) wrote:
> Thank you the ideas on this thread. The idea of writing an
> auditor/reactor to check the passwords was the most appealing
> initially, but I ran into a problem. By the time userauditor gets to
> see the password from newvalues['password'] it's already been
> hashed:
>
> {PBKDF2}10000$GeodPG9LmZAwMCRrv79u7oVTHyg$ZYZaios16Kiq4wYB4zHHV1Lo00Q
>
>So my string-based checked for minimum length, letters, numbers, punctuation
 > would pass for ANY password once it's hashed.
>
> Is there something I'm missing here? The userauditor.py approach fits
> my (small) brain.
>
...
> --
> David Hancock | [email protected]

You are not missing anything, I did, when I suggested the auditor 
approach, namely that they get called when the input is already processed.

In fact the standard templates implement a simple form of input 
validation *before* submitting the form via the JavaScript function 
checkRequiredFields(), which can be found in html/help_controls.js.

You could replace this function (in the right place/action) with one 
that checks the password strength too.

Some Google hits on 'JavaScript password strength validation', selected 
for not pulling in big JavaScript libraries:

http://stackoverflow.com/questions/948172/password-strength-meter
https://martech.zone/javascript-password-strength/

Best Regards,

   Georg Lehner


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot