A user may enter an empty password and still pass the server-side validation.

CommentFileSizeAuthor
#2 password_strength.password_validation.patch1.62 KBahayes08

Comments

web360’s picture

web360 commented

I have encountered the same issue, and am looking at the code right now. I'll post whatever I find.

Thanks!

Update:

Fixed issue by adding back the validation for blank passwords. The code below is from form.inc, and validates if the password field is blank.

On Line 231:

  elseif ($form['#required'] && !empty($form['#post'])) {
    form_error($form, t('Password field is required.'));
  }
ahayes08’s picture

ahayes08 commented
Priority: Normal » Critical
Status: Active » Needs review
StatusFileSize
new password_strength.password_validation.patch1.62 KB

See also #771236: Server check does not check if passwords match.

Attached patch to fix both issues.

coltrane’s picture

coltrane
he/him
commented
Issue summary: View changes
Status: Needs review » Closed (won't fix)

Original codebase was marked unsupported so this issue is no longer relevant after moving to new codebase https://www.drupal.org/node/2341503