diff --git a/logintoboggan.admin.inc b/logintoboggan.admin.inc index 0674a4c..4946426 100644 --- a/logintoboggan.admin.inc +++ b/logintoboggan.admin.inc @@ -158,7 +158,7 @@ function logintoboggan_main_settings() { '#description' => t('If enabled, users will receive a \'Log in successful\' message upon login.') ); $min_pass_options = array(t('None')); - for ($i = 2; $i < 30; $i++) { + for ($i = 6; $i < 30; $i++) { $min_pass_options[$i] = $i; } $form['other']['logintoboggan_minimum_password_length'] = array( @@ -166,7 +166,7 @@ function logintoboggan_main_settings() { '#title' => t('Minimum password length'), '#options' => $min_pass_options, '#default_value' => variable_get('logintoboggan_minimum_password_length', 0), - '#description' => t('LoginToboggan automatically performs basic password validation for illegal characters. If you would additionally like to have a minimum password length requirement, select the length here, or set to \'None\' for no password length validation.') + '#description' => t('Select the requirement for the minimum length of passwords. Drupal recommends a minimum of 6 characters to the user, but does not enforce this. Select 6 to have LoginToboggan enforce this setting. Select a higher value to recommend and enforce longer passwords. Alternatively, select \'None\' to keep the default Drupal behaviour.') ); return system_settings_form($form); diff --git a/logintoboggan.install b/logintoboggan.install index 5f20e8f..51f5674 100644 --- a/logintoboggan.install +++ b/logintoboggan.install @@ -38,6 +38,17 @@ function logintoboggan_update_7000(&$sandbox) { } /** + * The minimum setting for minimum password length is now 6. + * Otherwise it can be set to 0 for no minimum to be enforced. + */ +function logintoboggan_update_7001() { + $min_length = variable_get('logintoboggan_minimum_password_length',0); + if ($min_length > 0 && $min_length < 6) { + variable_set('logintoboggan_minimum_password_length',6); + } +} + +/** * Implement hook_uninstall(). */ function logintoboggan_uninstall() { diff --git a/logintoboggan.module b/logintoboggan.module index 7ec765f..463a915 100755 --- a/logintoboggan.module +++ b/logintoboggan.module @@ -212,6 +212,9 @@ function logintoboggan_form_user_profile_form_alter(&$form, &$form_state) { unset($form['account']['roles']['#options'][$id]); } } + + _logintoboggan_enforce_min_password_length($form); + } } @@ -260,11 +263,11 @@ function logintoboggan_form_user_register_form_alter(&$form, &$form_state) { $form['account']['name']['#weight'] = -30; $form['account']['mail']['#weight'] = -29; } - $min_pass = variable_get('logintoboggan_minimum_password_length', 0); - if ($pass && $min_pass > 0) { - $form['account']['pass']['#description'] = isset($form['account']['pass']['#description']) ? $form['account']['pass']['#description'] . " " : ""; - $form['account']['pass']['#description'] .= t('Password must be at least %length characters.', array('%length' => $min_pass)); + + if ($pass) { + _logintoboggan_enforce_min_password_length($form); } + } } @@ -413,6 +416,11 @@ function logintoboggan_js_alter(&$javascript) { $javascript['modules/user/user.permissions.js']['data'] = drupal_get_path('module', 'logintoboggan') . '/logintoboggan.permissions.js'; } } + + // Swap out user.js to use a customised version, allowing longer minimum length on passwords. + if (isset($javascript['modules/user/user.js'])) { + $javascript['modules/user/user.js']['data'] = drupal_get_path('module', 'logintoboggan') . '/logintoboggan.user.js'; + } } /** @@ -1093,6 +1101,66 @@ function _logintoboggan_process_redirect($redirect, $account) { } /** + * Enforce minimum password length. + */ +function _logintoboggan_enforce_min_password_length(&$form) { + $min_length = variable_get('logintoboggan_minimum_password_length', 0); + + if ($min_length > 0) { + $form['account']['pass']['#description'] = isset($form['account']['pass']['#description']) ? $form['account']['pass']['#description'] . " " : ""; + $form['account']['pass']['#description'] .= t('Password must be at least %length characters.', array('%length' => $min_length)); + } + $form['#process'][] = '_logintoboggan_form_process_password_confirm'; + + // If no Logintoboggan minimum is being enforced, we revert to the Drupal + // default behaviour of simply recommending a minimum length of 6. + if ($min_length < 6) { + $min_length = 6; + } + + // Add the minimum password length to Drupal.settings to make it available + // to logintoboggan.user.js. + drupal_add_js(array('logintoboggan' => array( + 'minPassLength' => $min_length, + )), 'setting'); + +} + +/** + * Form element process handler for client-side password validation. + * + * This #process handler is automatically invoked for 'password_confirm' form + * elements to add the JavaScript and string translations for dynamic password + * validation. + * + * @see system_element_info() + */ +function _logintoboggan_form_process_password_confirm($element) { + $min_length = variable_get('logintoboggan_minimum_password_length', 0); + + // If no Logintoboggan minimum is being enforced, we revert to the Drupal + // default behaviour of simply recommending a minimum length of 6. + if ($min_length < 6) { + $min_length = 6; + } + + $js_settings = array( + 'password' => array( + 'logintobogganTooShort' => t('Make it at least %min_length characters', array('%min_length' => $min_length)), + ), + ); + + // Ensure settings are only added once per page. + static $already_added = FALSE; + if (!$already_added) { + $already_added = TRUE; + $element['#attached']['js'][] = array('data' => $js_settings, 'type' => 'setting'); + } + + return $element; +} + +/** * Implement hook_mail_alter(). */ function logintoboggan_mail_alter(&$message) { diff --git a/logintoboggan.user.js b/logintoboggan.user.js new file mode 100644 index 0000000..53b6df7 --- /dev/null +++ b/logintoboggan.user.js @@ -0,0 +1,202 @@ +/** + * Override core user.js + * Allows a longer minimum password length to be specified + */ + +(function ($) { + +/** + * Attach handlers to evaluate the strength of any password fields and to check + * that its confirmation is correct. + */ +Drupal.behaviors.password = { + attach: function (context, settings) { + var translate = settings.password; + $('input.password-field', context).once('password', function () { + var passwordInput = $(this); + var innerWrapper = $(this).parent(); + var outerWrapper = $(this).parent().parent(); + + // Add identifying class to password element parent. + innerWrapper.addClass('password-parent'); + + // Add the password confirmation layer. + $('input.password-confirm', outerWrapper).after('
' + translate['confirmTitle'] + '
').parent().addClass('confirm-parent'); + var confirmInput = $('input.password-confirm', outerWrapper); + var confirmResult = $('div.password-confirm', outerWrapper); + var confirmChild = $('span', confirmResult); + + // Add the description box. + var passwordMeter = '
' + translate['strengthTitle'] + '
'; + $(confirmInput).parent().after('
'); + $(innerWrapper).prepend(passwordMeter); + var passwordDescription = $('div.password-suggestions', outerWrapper).hide(); + + // Check the password strength. + var passwordCheck = function () { + + // Evaluate the password strength. + var result = Drupal.evaluatePasswordStrength(passwordInput.val(), settings.password); + + // Update the suggestions for how to improve the password. + if (passwordDescription.html() != result.message) { + passwordDescription.html(result.message); + } + + // Only show the description box if there is a weakness in the password. + if (result.strength == 100) { + passwordDescription.hide(); + } + else { + passwordDescription.show(); + } + + // Adjust the length of the strength indicator. + $(innerWrapper).find('.indicator').css('width', result.strength + '%'); + + // Update the strength indication text. + $(innerWrapper).find('.password-strength-text').html(result.indicatorText); + + passwordCheckMatch(); + }; + + // Check that password and confirmation inputs match. + var passwordCheckMatch = function () { + + if (confirmInput.val()) { + var success = passwordInput.val() === confirmInput.val(); + + // Show the confirm result. + confirmResult.css({ visibility: 'visible' }); + + // Remove the previous styling if any exists. + if (this.confirmClass) { + confirmChild.removeClass(this.confirmClass); + } + + // Fill in the success message and set the class accordingly. + var confirmClass = success ? 'ok' : 'error'; + confirmChild.html(translate['confirm' + (success ? 'Success' : 'Failure')]).addClass(confirmClass); + this.confirmClass = confirmClass; + } + else { + confirmResult.css({ visibility: 'hidden' }); + } + }; + + // Monitor keyup and blur events. + // Blur must be used because a mouse paste does not trigger keyup. + passwordInput.keyup(passwordCheck).focus(passwordCheck).blur(passwordCheck); + confirmInput.keyup(passwordCheckMatch).blur(passwordCheckMatch); + }); + } +}; + +/** + * Evaluate the strength of a user's password. + * + * Returns the estimated strength and the relevant output message. + */ +Drupal.evaluatePasswordStrength = function (password, translate) { + var weaknesses = 0, strength = 100, msg = []; + + var hasLowercase = password.match(/[a-z]+/); + var hasUppercase = password.match(/[A-Z]+/); + var hasNumbers = password.match(/[0-9]+/); + var hasPunctuation = password.match(/[^a-zA-Z0-9]+/); + + // If there is a username edit box on the page, compare password to that, otherwise + // use value from the database. + var usernameBox = $('input.username'); + var username = (usernameBox.length > 0) ? usernameBox.val() : translate.username; + + // Lose 5 points for every character less than the minimum, plus a 30 point penalty. + var minLength = Drupal.settings.logintoboggan.minPassLength; + if (password.length < minLength) { + msg.push(translate.logintobogganTooShort); + strength -= ((minLength - password.length) * 5) + 30; + } + + // Count weaknesses. + if (!hasLowercase) { + msg.push(translate.addLowerCase); + weaknesses++; + } + if (!hasUppercase) { + msg.push(translate.addUpperCase); + weaknesses++; + } + if (!hasNumbers) { + msg.push(translate.addNumbers); + weaknesses++; + } + if (!hasPunctuation) { + msg.push(translate.addPunctuation); + weaknesses++; + } + + // Apply penalty for each weakness (balanced against length penalty). + switch (weaknesses) { + case 1: + strength -= 12.5; + break; + + case 2: + strength -= 25; + break; + + case 3: + strength -= 40; + break; + + case 4: + strength -= 40; + break; + } + + // Check if password is the same as the username. + if (password !== '' && password.toLowerCase() === username.toLowerCase()) { + msg.push(translate.sameAsUsername); + // Passwords the same as username are always very weak. + strength = 5; + } + + // Based on the strength, work out what text should be shown by the password strength meter. + if (strength < 60) { + indicatorText = translate.weak; + } else if (strength < 70) { + indicatorText = translate.fair; + } else if (strength < 80) { + indicatorText = translate.good; + } else if (strength <= 100) { + indicatorText = translate.strong; + } + + // Assemble the final message. + msg = translate.hasWeaknesses + ''; + return { strength: strength, message: msg, indicatorText: indicatorText } + +}; + +/** + * Field instance settings screen: force the 'Display on registration form' + * checkbox checked whenever 'Required' is checked. + */ +Drupal.behaviors.fieldUserRegistration = { + attach: function (context, settings) { + var $checkbox = $('form#field-ui-field-edit-form input#edit-instance-settings-user-register-form'); + + if ($checkbox.size()) { + $('input#edit-instance-required', context).once('user-register-form-checkbox', function () { + $(this).bind('change', function (e) { + if ($(this).attr('checked')) { + $checkbox.attr('checked', true); + } + }); + }); + + } + } +}; + +})(jQuery);