Problem/Motivation
Validation for passwords containing special unicode characters is not fully supported.
There is an issue with the way strings are iterated through, proper string size is calculated but the
<?php
$password[$i]
?>
approach goes through the string in 8bit increments so for example:
<?php
$password = "ăăPassword1" ;
$length = mb_strlen($password);
echo $length;
for($i = 0; $i<$length; $i++){
echo $password[$i];
}
?>
Will output:
11ăăPasswor
Proposed resolution
We could use a function like:
http://www.php.net/manual/en/function.str-split.php#97690
<?php
function uni_strsplit($string, $split_length=1)
{
preg_match_all('`.`u', $string, $arr);
$arr = array_chunk($arr[0], $split_length);
$arr = array_map('implode', $arr);
return $arr;
}
?>
to get an array of actual unicode characters and then iterate with foreach
Remaining tasks
I will try to provide a patch, but please confirm that this is an issue.
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | password_policy-true_unicode_support_followup-1251756-5.patch | 1.21 KB | pbuyle |
| #3 | password_policy-true_unicode_support-1251756-3.patch | 6.26 KB | erikwebb |
| #1 | unicode-1251756-1.patch | 5.98 KB | sionescu |
Comments
Comment #1
sionescu commentedThis is the patch against master.
The password_policy_unicode_str_to_array function can be improved and moved to Drupal Core unicode.inc.
Comment #2
erikwebb commentedI think strictly using either the PHP Multibyte String functions or, even better, Drupal's mbstring-safe functions drupal_strlen() and drupal_substr() would be a better approach.
Comment #3
erikwebb commentedI think this general solution makes more sense -
Look good?
Comment #4
erikwebb commentedFixed and committed.
http://drupalcode.org/project/password_policy.git/commit/f346f3e
Comment #5
pbuyle commentedThe commited patch still use the now undefined
password_policy_unicode_str_to_array()function inpassword_policy_constraint_letter_validate().The attached patch should fix the issue.
Comment #6
erikwebb commentedI know it's semantics, but in the future you should open a new issue and point to this one (even if I made a mistake in this commit).
Also you made this Git patch from a base level Git repo instead of one rooted in the module itself. I fixed the patch and committed with attribution.
http://drupalcode.org/project/password_policy.git/commit/9f404ef