rollerworks / PasswordStrengthBundle

Symfony Password strength and blacklisting validator bundle
MIT License
142 stars 26 forks source link

Fix: Use minLength as correct minimum for passwordStrength calculation #43

Closed mennowame closed 9 years ago

mennowame commented 9 years ago

The minLength appears to be used in two different ways:

For length validation: password has to be equal or bigger than minLength

For strength validation: password has to be bigger than minLength

This way the password will not validate if it has exactly the minLength and does exactly meet the other strength requirements. E.g.: Password validation with minLength = 8 and minStrength = 3: Test1234 will not validate (even though length is 8, there is a uppercase and lowercase character and there is a digit). Test12345 will validate (because password is bigger than the required 8 characters).

This is why i've changed the passLength check in the passwordStrenght calculation of the validate function, so exactly the minimum length will result in an extra strength point. I think this is more like it is intended to be, but correct me if i'm wrong :)

mennowame commented 9 years ago

Because this changes the way the password strength is calculated, the tests fail, I was busy trying to fix the tests but found more issues with the strength. for example: abcd! will have strength 0 1234! will have strength 2 I'm changing this and checking the tests, this will replace this pull request.

sstok commented 9 years ago

OK, thanks for you contributions :+1:

mennowame commented 9 years ago

pull request #47 replaced this pull request