Changeset 13189 for trunk/src/bp-settings/actions/general.php

Timestamp:

12/16/2021 06:16:38 PM (3 years ago)

Author:

imath

Message:

Introduce a new constant/filter to enforce strong password in BP areas

You can now use the BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH constant or alternatively the 'bp_members_user_pass_required_strength' filter to force members to use password satisfying a strength score from 4 (strong) to 1 (weak). For instance use define ( 'BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH', 4 ); to enforce strong passwords.

This setting will only be applied to these 2 BuddyPress specific areas:

• the registration form,
• the General User's front-end profile settings tab.

PS: this commit also removes completely the password-verify script from the BP Nouveau Template Pack which was deprecated since BuddyPress 5.0.

Props niftythree, dcavins

Fixes #8589

File:

• trunk/src/bp-settings/actions/general.php (modified) (2 diffs)

trunk/src/bp-settings/actions/general.php

@@ -74 +74 @@
             // User is changing email address.
             if ( $old_user_email !== $user_email ) {
-
                 // Run some tests on the email address.
                 $email_checks = bp_core_validate_email_address( $user_email );
@@ -135 +134 @@
             $pass         = wp_unslash( $_POST['pass1'] );
             $pass_confirm = wp_unslash( $_POST['pass2'] );
-            $pass_error   = bp_members_validate_user_password( $pass, $pass_confirm, $update_user );
-
-            if ( ! $pass_error->get_error_message() ) {
-                // Password change attempt is successful.
-                if ( ( ! empty( $_POST['pwd'] ) && wp_unslash( $_POST['pwd'] ) !== $pass ) || is_super_admin() )  {
-                    $update_user['user_pass'] = $_POST['pass1'];
-                    $pass_error               = false;
-                    $pass_changed             = true;
-
-                // The new password is the same as the current password.
-                } else {
-                    $pass_error->add( 'same_user_password', __( 'The new password must be different from the current password.', 'buddypress' ) );
+
+            // Password strength check.
+            $required_password_strength = bp_members_user_pass_required_strength();
+            $current_password_strength  = null;
+            if ( isset( $_POST['_password_strength_score'] ) ) {
+                $current_password_strength = (int) $_POST['_password_strength_score'];
+            }
+
+            if ( $required_password_strength && ! is_null( $current_password_strength ) && $required_password_strength > $current_password_strength ) {
+                $pass_error = new WP_Error(
+                    'not_strong_enough_password',
+                    __( 'Your password is not strong enougth to be allowed on this site. Please use a stronger password.', 'buddypress' )
+                );
+            } else {
+                $pass_error = bp_members_validate_user_password( $pass, $pass_confirm, $update_user );
+
+                if ( ! $pass_error->get_error_message() ) {
+                    // Password change attempt is successful.
+                    if ( ( ! empty( $_POST['pwd'] ) && wp_unslash( $_POST['pwd'] ) !== $pass ) || is_super_admin() )  {
+                        $update_user['user_pass'] = $_POST['pass1'];
+                        $pass_error               = false;
+                        $pass_changed             = true;
+
+                    // The new password is the same as the current password.
+                    } else {
+                        $pass_error->add( 'same_user_password', __( 'The new password must be different from the current password.', 'buddypress' ) );
+                    }
                 }
             }