Changeset 13189 for trunk/src/bp-members/screens/register.php

Timestamp:

12/16/2021 06:16:38 PM (3 years ago)

Author:

imath

Message:

Introduce a new constant/filter to enforce strong password in BP areas

You can now use the BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH constant or alternatively the 'bp_members_user_pass_required_strength' filter to force members to use password satisfying a strength score from 4 (strong) to 1 (weak). For instance use define ( 'BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH', 4 ); to enforce strong passwords.

This setting will only be applied to these 2 BuddyPress specific areas:

• the registration form,
• the General User's front-end profile settings tab.

PS: this commit also removes completely the password-verify script from the BP Nouveau Template Pack which was deprecated since BuddyPress 5.0.

Props niftythree, dcavins

Fixes #8589

File:

• trunk/src/bp-members/screens/register.php (modified) (2 diffs)

trunk/src/bp-members/screens/register.php

@@ -16 +16 @@
     $bp = buddypress();
 
-    if ( ! bp_is_current_component( 'register' ) || bp_current_action() )
+    if ( ! bp_is_current_component( 'register' ) || bp_current_action() ) {
         return;
+    }
 
     // Not a directory.
@@ -88 +89 @@
         }
 
-        $signup_pass = '';
-        if ( isset( $_POST['signup_password'] ) ) {
-            $signup_pass = wp_unslash( $_POST['signup_password'] );
-        }
-
-        $signup_pass_confirm = '';
-        if ( isset( $_POST['signup_password_confirm'] ) ) {
-            $signup_pass_confirm = wp_unslash( $_POST['signup_password_confirm'] );
-        }
-
-        // Check the account password for problems.
-        $account_password = bp_members_validate_user_password( $signup_pass, $signup_pass_confirm );
-        $password_error   = $account_password->get_error_message();
+        // Password strength check.
+        $required_password_strength = bp_members_user_pass_required_strength();
+        $current_password_strength  = null;
+        if ( isset( $_POST['_password_strength_score'] ) ) {
+            $current_password_strength = (int) $_POST['_password_strength_score'];
+        }
+
+        if ( $required_password_strength && ! is_null( $current_password_strength ) && $required_password_strength > $current_password_strength ) {
+            $account_password = new WP_Error(
+                'not_strong_enough_password',
+                __( 'Your password is not strong enougth to be allowed on this site. Please use a stronger password.', 'buddypress' )
+            );
+        } else {
+            $signup_pass = '';
+            if ( isset( $_POST['signup_password'] ) ) {
+                $signup_pass = wp_unslash( $_POST['signup_password'] );
+            }
+
+            $signup_pass_confirm = '';
+            if ( isset( $_POST['signup_password_confirm'] ) ) {
+                $signup_pass_confirm = wp_unslash( $_POST['signup_password_confirm'] );
+            }
+
+            // Check the account password for problems.
+            $account_password = bp_members_validate_user_password( $signup_pass, $signup_pass_confirm );
+        }
+
+        $password_error = $account_password->get_error_message();
 
         if ( $password_error ) {