mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 02:52:33 -05:00
Lauri Ojansivu
c99aa7f845
PASSWORD_MIN_LENGTH (default 8) is now the length below which a sign-in is REPORTED, in the new Admin Panel / Problems / Password length, and PASSWORD_MIN_LENGTH_ENFORCE (off by default) is what makes it a rule: a shorter new password is refused, and an account that signs in with an older shorter one sees only "Change your password" until it has a long enough one. Signing in is never refused, enforced or not, so nobody is locked out by a minimum set after their password. LDAP, OAuth2, OIDC, SAML, CAS and Sandstorm accounts are neither reported nor asked: their password is their provider's. An administrator's Set password no longer applies WeKan's policy to such an account. Meteor sends a password hashed, so only the browser knows its length: it notes it on the sign-in form and, after a sign-in that worked, says "it was short" - never the password or its length. The page has both settings and a table, one row per account: username, first and last short-password login, the latest IPv4 and IPv6 address with the country's flag and city when a CDN says where it is, the count, and when it was fixed, with the Too short (default) / Fixed / All filter. Fixed is a changed password not seen short since; a short one seen again reopens the row. Changing one's own password - Member Settings, the forced change, a reset link - now signs EVERY session of the account out, the one that changed it too, and only the new password signs in again. The browser goes to the sign-in page as soon as it is signed out, since the server closes the connection before the answer can arrive. Documented in docs/Features/Admin-Panel/Problems/Password-length.md, the settings on every platform. The new strings are in every locale in English for now. Tests: passwordPolicy, passwordChangeRequired and shortPasswordLogins (node); password-min-length-signup-login, password-length-report and password-change-other-sessions (Playwright, Chromium and WebKit), which change each setting on the page and check what it does, and that sign-up with no mail server registers and signs the user in. Thanks to xet7 !
