search

owncloud / password_policy

๐Ÿ›ก๏ธ Define password policies for user and public link passwords
GNU General Public License v2.0
6 stars 6 forks source link

Counting of emojis as special characters #141

Open phil-davis opened 6 years ago

phil-davis commented 6 years ago
  1. enable the special characters password policy, and set it to 10
  2. enable "Restrict to these special characters" and put an emoji, e.g. ๐Ÿ˜€ in the special characters list.
  3. add a user, change their password... giving only 2 ๐Ÿ˜€๐Ÿ˜€ in the password - you get an error message, good.
  4. add a user, change their password... giving 3 ๐Ÿ˜€๐Ÿ˜€๐Ÿ˜€ in the password. The password is saved.

It seems that the smiley emoji counts as 4 characters, and 3 of them is enough to exceed the 12 special characters requirement.

I guess that this will apply to other Unicode characters whose storage is greater than 1 byte. Probably the special characters is counting bytes of special character, rather the number of "functional" characters.

Firstly, what is the actual reasonable requirement here, if people put Unicode characters in this special characters field?

phil-davis commented 6 years ago

I tried with the Devanagari Nepali character เคจ - 3 of those are not enough, 4 of those gets to the 10 character limit. So I guess that Unicode character is 3 bytes long. Somebody might actually do this sort of thing in India or Russia (Cyrillic) or...

PVince81 commented 6 years ago

@settermjd do you know if there are any best practices in such cases ?

technically we could replace strlen and find another PHP function that counts the actual chars