search

ulsdevteam / pkp-betterPassword

Plugin to implement password requirements for PKP OJS/OMP
GNU General Public License v2.0
7 stars 6 forks source link

Extend validation to other forms #19

Open jonasraoni opened 3 years ago

jonasraoni commented 3 years ago

mustChangePassword

If the user has the flag mustChangePassword, then the lock mechanism is ignored in this form, maybe it should be enabled?!

Administration

When creating a new user, the password security isn't enforced on the password field. Perhaps it's ok, so I'm just leaving a note.

ctgraham commented 3 years ago

I bet we will have administrators with differing opinions on enforcing password requirements from the user administration form. I personally lean toward the position that requirements should be enforced or password changed should be required at next login.

Which form is ignoring the lock mechanism? If it is the password reset form, this is intentional. A password reset unlocks the user after bad password attempts.

jonasraoni commented 3 years ago

The issue about the mustChangePassword was just a bad test from my part, ignore :)