Skip to:
Content

BuddyPress.org

Opened 5 months ago

Closed 6 weeks ago

Last modified 6 weeks ago

#9332 closed defect (bug) (fixed)

Nouveau: 'strong' password enforcement still enables submit button on `medium` strength

Reported by: r-a-y Owned by: dcavins
Priority: normal Milestone: 14.5.2
Component: Templates Version: 10.0.0
Severity: normal Keywords: has-patch has-test-info has-screenshots commit
Cc:

Description

In BuddyPress 10, password enforcement was added (#8589).

If I set password enforcement to strong with:

define( 'BP_MEMBERS_REQUIRED_PASSWORD_STRENGTH', 4 )

or:

add_filter( 'bp_members_user_pass_required_strength', function() { return 4; } );

On the registration page or when on the "Settings > General" page, if a medium strength password is entered, the submit button is enabled when it should only be enabled when the password is strong. See attached GIF.

The problem is due to a conflict with enqueuing /wp-admin/js/user-profile.js: https://github.com/WordPress/WordPress/blob/dde3a47f0bc5ebbe792aa1bb572506953b59db63/wp-admin/js/user-profile.js#L434. user-profile.js re-enables the submit button even on medium strength. To solve this, we can add a small timeout in Nouveau's JS to ensure the submit button is disabled when our required password strength is not met. See attached patch.

Attached patch also re-initializes the passwordWarningContainer variable so it is able to find the injected #password-warning addition to the DOM. This fixes an issue where the password warning would not show up again when a strong password is edited to become a medium one on the first keydown.

Attachments (2)

9332.01.patch (840 bytes ) - added by r-a-y 5 months ago.
9332-before-after-patch-07-13-2026_06_23_AM.png (74.9 KB ) - added by emaralive 2 months ago.
Screenshot of test result info

Download all attachments as: .zip

Change History (12)

@r-a-y
5 months ago

#1 @darshitrajyaguru97
5 months ago

  • Keywords has-patch needs-testing added

#2 @emaralive
2 months ago

  • Keywords has-test-info has-screenshots commit added; needs-testing removed
  • Milestone Awaiting Review14.5.1

Tested the patch and it performs as advertised, see screenshot for testing info, the top image is a "Before" patch and the bottom image is a "After" patch. The patch can be applied to both the BP 14.0 branch and trunk (15.0).

@emaralive
2 months ago

Screenshot of test result info

#3 @dcavins
6 weeks ago

  • Owner set to dcavins
  • Resolutionfixed
  • Status newclosed

In 14216:

Nouveau: Enforce 'strong' password level (14.0 branch).

Resolve a conflict with /wp-admin/js/user-profile.js that allows the user to submit a password satisfying the medium strength test when strong passwords are required.

Fixes #9332.

Props r-a-y, emaralive.

#4 @dcavins
6 weeks ago

In 14220:

Nouveau: Enforce 'strong' password level (12.0 branch).

Resolve a conflict with /wp-admin/js/user-profile.js that allows the user to submit a password satisfying the medium strength test when strong passwords are required.

See #9332.

Props r-a-y, emaralive.

#5 @dcavins
6 weeks ago

In 14224:

Nouveau: Enforce 'strong' password level (11.0 branch).

Resolve a conflict with /wp-admin/js/user-profile.js that allows the user to submit a password satisfying the medium strength test when strong passwords are required.

Fixes #9332.

Props r-a-y, emaralive.

#6 @dcavins
6 weeks ago

In 14230:

Nouveau: Enforce 'strong' passwords (14.0 branch).

Avoid arrow functions in JS.

See #9332.

#7 @dcavins
6 weeks ago

In 14233:

Nouveau: Enforce 'strong' passwords (12.0 branch).

Avoid arrow functions.

See #9332.

#8 @dcavins
6 weeks ago

In 14236:

Nouveau: Enforce 'strong' passwords (11.0 branch).

Avoid arrow functions.

See #9332.

#9 @dcavins
6 weeks ago

In 14240:

Nouveau: Enforce 'strong' password level (14.0 branch).

Resolve a conflict with /wp-admin/js/user-profile.js that allows the user to submit a password satisfying the medium strength test when strong passwords are required.

Fixes #9332.

Props r-a-y, emaralive.

#10 @espellcaste
6 weeks ago

  • Milestone 14.5.114.5.2
Note: See TracTickets for help on using tickets.