Problem/Motivation

Validation for passwords containing special unicode characters is not fully supported.

There is an issue with the way strings are iterated through, proper string size is calculated but the

<?php
$password[$i]
?>

approach goes through the string in 8bit increments so for example:

<?php
$password = "ăăPassword1" ;
$length = mb_strlen($password);

echo $length;
for($i = 0; $i<$length; $i++){
  echo $password[$i];
}
?>

Will output:

11ăăPasswor

Proposed resolution

We could use a function like:
http://www.php.net/manual/en/function.str-split.php#97690

<?php
function uni_strsplit($string, $split_length=1)
{
    preg_match_all('`.`u', $string, $arr);
    $arr = array_chunk($arr[0], $split_length);
    $arr = array_map('implode', $arr);
    return $arr;
}
?>

to get an array of actual unicode characters and then iterate with foreach

Remaining tasks

I will try to provide a patch, but please confirm that this is an issue.

Comments

sionescu’s picture

StatusFileSize
new5.98 KB

This is the patch against master.
The password_policy_unicode_str_to_array function can be improved and moved to Drupal Core unicode.inc.

erikwebb’s picture

Status: Active » Needs work

I think strictly using either the PHP Multibyte String functions or, even better, Drupal's mbstring-safe functions drupal_strlen() and drupal_substr() would be a better approach.

erikwebb’s picture

Version: 7.x-1.0-beta1 » 7.x-1.x-dev
Status: Needs work » Needs review
StatusFileSize
new6.26 KB

I think this general solution makes more sense -

  $chars = drupal_strlen($password);
  $num = 0;
  for ($i = 0; $i < $chars; ++$i) {
    if (ctype_alnum(drupal_substr($password, $i, 1))) {
      $num++;
    }
  }

Look good?

erikwebb’s picture

Title: True unicode support. » True unicode support
Status: Needs review » Fixed
pbuyle’s picture

Status: Fixed » Needs review
StatusFileSize
new1.21 KB

The commited patch still use the now undefined password_policy_unicode_str_to_array() function in password_policy_constraint_letter_validate().

The attached patch should fix the issue.

erikwebb’s picture

Status: Needs review » Fixed

I know it's semantics, but in the future you should open a new issue and point to this one (even if I made a mistake in this commit).

Also you made this Git patch from a base level Git repo instead of one rooted in the module itself. I fixed the patch and committed with attribution.

http://drupalcode.org/project/password_policy.git/commit/9f404ef

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.