password_policy doesn't reject passwords like "aaa", "aaaa", or even "aaaaa" when the consecutive letter constraint is set to three. I stepped through it with the debugger and I think the regex is wrong. See patch.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

jsagotsky’s picture

New issue queue keeps eating my patch. Here's a link instead. https://gist.github.com/sagotsky/7321750

(Not that this helps drush make...)

erikwebb’s picture

How does the consecutive constraint test pass if this is an issue? Should we update that test to use "2" as the count as well?

erikwebb’s picture

Version: 7.x-2.0-alpha1 » 7.x-2.x-dev
jsagotsky’s picture

erikwebb,

Yeah, it looks like the test needs an update. I wrote a quick script to mimic the test with the original and patched patterns.


// mimic psasword_policy's test cases

$constraint = 2;

$patterns = array(
  'original' => '/(.)[\1]{'.($constraint-1).'}/',   
  'patched' => '/(.)\1{'.($constraint-1).'}/',     
);

foreach ($patterns as $label => $pattern) {
  foreach (array('', 'a', 'ab', 'aba', 'aab', 'aaab') as $password) {
    $status = (!preg_match($pattern, $password)) ? 'pass' : 'fail';
    print "$label '$password' $status \n";
  }
}

Results are identical when the constraint is 1. When I up it to 2, the original pattern lets through 'aab' and 'aaab'.

erikwebb’s picture

Okay, please include an update to our test in the patch.

jsagotsky’s picture

jsagotsky’s picture

Updated. Just in case the issue queue continues to be wonky about uploads, here's a gist. https://gist.github.com/sagotsky/7321750#file-password_policy-consecutiv...

coltrane’s picture

Status: Active » Needs review

(setting to CNR so testbot will have it tested)

coltrane’s picture

Status: Needs review » Reviewed & tested by the community

#6 passed tests and also worked for me locally. RTBC I think

erikwebb’s picture

Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.