https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |18298 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18298 [Bug 18298] Allow enforcing password complexity -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Koha enforces three |Koha enforces three (3) |character password length |character password length |even if |even if |RequireStrongPassword is |RequireStrongPassword is |disabled |disabled -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 --- Comment #3 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Jonathan Druart from comment #1)

Hi Kyle, another pref drives this behavior, see minPasswordLength

That is not correct, that bug hard coded the 3 limit in such that if minPassword is less than 3 it is changed to 3. Please see the patch file for where this happens. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 Dilan Johnpullé <dilan@calyx.net.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dilan@calyx.net.au --- Comment #5 from Dilan Johnpullé <dilan@calyx.net.au> --- Created attachment 78427 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=78427&action=edit Error message when changing password Applied the patch, restarted plack, apache and memcached and attempted to set a patron password of 2 characters after changing the sysprefs as per the test plan. I'm getting a very confusing error message saying that I'm not entering two characters even though I am. I tried setting the minPasswordLength syspref to one but it then complains that I'm not entering at least 1 character. This is also true if I type in a password with two characters. It looks like it's still searching for three characters when changing patron passwords. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 --- Comment #7 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 78432 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=78432&action=edit Bug 21314: Fix duplicate code in Koha::AuthUtils::is_password_valid -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 --- Comment #9 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Dilan Johnpullé from comment #5)

Created attachment 78427 [details] Error message when changing password

Applied the patch, restarted plack, apache and memcached and attempted to set a patron password of 2 characters after changing the sysprefs as per the test plan.

I'm getting a very confusing error message saying that I'm not entering two characters even though I am. I tried setting the minPasswordLength syspref to one but it then complains that I'm not entering at least 1 character. This is also true if I type in a password with two characters.

It looks like it's still searching for three characters when changing patron passwords.

This followup patch should take care of the error you are getting Dilan! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 --- Comment #11 from Kyle M Hall <kyle@bywatersolutions.com> --- (In reply to Marcel de Rooy from comment #10)

+ if ( C4::Context->preference('RequireStrongPassword') ) { + $minPasswordLength = 3 if $minPasswordLength < 3; + }

How strong is that? LOL Imo we should enforce at least 8 chars or so, and educate users that security has a price.

Agreed, but that's another bug report ;) IMO we should have a syspref where we can add a custom or canned regex to define password difficulty. But again, that's quite out of scope here. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 Benjamin Daeuber <bdaeuber@cityoffargo.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bdaeuber@cityoffargo.com --- Comment #13 from Benjamin Daeuber <bdaeuber@cityoffargo.com> --- (In reply to Marcel de Rooy from comment #10)

+ if ( C4::Context->preference('RequireStrongPassword') ) { + $minPasswordLength = 3 if $minPasswordLength < 3; + }

How strong is that? LOL Imo we should enforce at least 8 chars or so, and educate users that security has a price.

As the library in question, I have to say that I agree with you personally, but professionally I believe this would be a barrier to service. We serve a broad range from the very young to very old to customers with severe learning disabilities. Education is simply not always an option. Users have to use their password to access public computers (as well as a variety of other services) and the true outcome here is that we would spend our time resetting passwords all day long. Last names are easy to remember and secure enough to prevent abuse when cards are lost (which a default password would not be). -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtompset@hotmail.com Status|Needs Signoff |Failed QA --- Comment #15 from M. Tompsett <mtompset@hotmail.com> --- git grep -l minPasswordLength -- there are other places: Koha/Patron.pm, C4/InstallAuth.pm --- BEGIN FURTHER THOUGHTS --- Perhaps a C4::Context function to return this value, so you don't end up putting the same code in 4 spots? Also, perhaps cutting the minPasswordLength from the template variables set, and update Koha/Template/Plugin/Koha.pm with a call to the new C4::Context function? because I also noticed the password_check.inc files. just reading members/member-password.tt -- Hmmm... logic there might be broken, because you could set minPasswordLength=2, RequireStrongPassword = true, and then you need 3, but the message will say 2. Another good place for such a tweak to the plugin. members/memberentrygen.tt bypasses this issue, by using the template value. similarly, opac-passwd.tt. similarly, opac-password-recovery.tt opac-memberentry.tt uses the template value, but also has a direct preference call too. DOH! DOH! AuthUtils.t doesn't test for the 2 but strong case. That's beyond scope. Koha/Patrons.t doesn't maybe? Beyond scope, but I'm still looking at all minPasswordLength files not po files. :) Hmmm... api patron test file mocks the system preference. *shrug* --- END FURTHER THOUGHTS --- Okay... to summarize: Failed QA because git grep -l minPasswordLength -- there are other places: Koha/Patron.pm, C4/InstallAuth.pm -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21314 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cbrannon@cdalibrary.org --- Comment #16 from Christopher Brannon <cbrannon@cdalibrary.org> --- (In reply to Marcel de Rooy from comment #10)

+ if ( C4::Context->preference('RequireStrongPassword') ) { + $minPasswordLength = 3 if $minPasswordLength < 3; + }

How strong is that? LOL Imo we should enforce at least 8 chars or so, and educate users that security has a price.

Our library practices similar methods, and we've run into this issue as well. I've never liked software that tells users how to enforce their security. The options should be there, and how secure or insecure they choose to run it should be up to them. However, there are bugs, like https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33462 that focus on improving things in another way, which would give us more flexibility and options. It just feels like libraries are being forced to bend to the will of programmers based on personal opinions. There are a lot of minimum values that could be forced on libraries and their patrons, but that should be the choice of the library, not the program. Imo, our default passwords SHOULD be stronger. But I don't get to make that decision, so why should a developer? -- You are receiving this mail because: You are watching all bug changes.