Releases for Password Policy

Dev branch

Thanks for using the password policy module.

Enjoy the new release!

Changes since 8.x-3.1 release:

Our first full release - lots of issues merged, many improvements to automated tests and module compatibilities.

Changes since 8.x-3.0-alpha4:
#2956550 by Sivaprasad C, AohRveTPV: Fix dependency declaration
#2948046 by emartoni: Configuration link is wrong on README.md
#2843326 by aamouri, voleger: Missing use t() function for some messages
#2856294 by Znak: Deprecated methods

See Password Policy - Less critical - Denial of Service - SA-CONTRIB-2018-077

Other changes since 7.x-1.15:

Numerous bug fixes and a new consecutive character constraint

Changes since 7.x-1.12:

Many improvements and bug fixes.

Changes since 7.x-2.0-alpha5:

Changes since 7.x-1.11:

Changes since 7.x-2.0-alpha4:

See Password Policy - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-090

Other changes since 7.x-1.10:

Changes since 6.x-1.9:

• #2357511 by Ranieri Machado: !mailto token not working
• Improved some code per Coder Review.

This release adds compatibility with the Secure Password Hashes module. If your site uses both the Secure Password Hashes and Password Policy modules, you are advised to upgrade to this release.

Prior to this release, the following Password Policy features did not work properly with Secure Password Hashes installed:

• History constraint
• Forced password changes

Other changes since 6.x-1.8:

Fixes SA-CONTRIB-2014-070 - Password Policy - Access Bypass

Other changes since 7.x-1.8:

This release is mainly to fix a "division by zero" error that could occur when upgrading to 7.x-1.7. The error is harmless, but could cause uncertainty over whether the updates completed successfully.

Changes since 7.x-1.7:

IMPORTANT: If your site used Password Policy 6.x in the past:

• You should back up your database prior to applying this update to minimize risk of losing password history due to unforeseen update problems.
• Be warned that the database updates might take a long time to run for sites with many users.

Changes since 7.x-1.6:

Issues in this release:
Fixes SA-CONTRIB-2014-057 - Password policy - General logic error

Validate user input and add check_plain for display of the "Password Expiration Warning" field

SA-CONTRIB-2013-069 - Password Policy - XSS

First alpha release of 7.x-2.x

 
• Removed client-side password history checks. See SA-CONTRIB-2012-159 - Password policy - Information leakage of hashed passwords for more details.

 

• Add constraint includes to each test case.

 

• #1800280: Notice when $account->roles is not set

 

The username constraint now checks for the username anywhere in the password, rather than the exact password. This should probably have been the behavior all along and won't directly affect existing passwords.

Changes since 7.x-1.0:

• #1666054: Stricter username constraint

It's about time for an official D7 release!

Changes since 7.x-1.0-rc3 -

• #1539196: Delay constraint issues fatal error when account has not yet been created
• #1463568: Expired Password Issue
• #1251756: True unicode support

#1415416: password_policy_user_login() uses D6 style db queries
#958794: Add a short description above policies for user