Skip to content

fix(forms): clamp password minimum length to 6 #3187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
faisalahammad wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

fix(forms): clamp password minimum length to 6 #3187

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelogs/issue-3045-password-min-length.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
significance: patch
type: fixed
entry: Fixed issue where the minimum password length could be set below the absolute minimum of 6, causing passwords to be rejected as too short. The password strength meter and form validator now explicitly clamp the minimum length to 6.
2 changes: 2 additions & 0 deletions includes/forms/class-llms-form-validator.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,8 @@ public function validate_field( $posted_value, $field ) {
*/
protected function validate_field_attribute_minlength( $posted_value, $minlength, $field ) {

$minlength = max( 6, absint( $minlength ) );

if ( strlen( $posted_value ) < $minlength ) {
return new WP_Error(
'llms-form-field-invalid',
Expand Down
2 changes: 1 addition & 1 deletion includes/forms/class-llms-forms-dynamic-fields.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ public function add_password_strength_meter( $blocks, $location ) {
'id' => 'llms-password-strength-meter',
'classes' => 'llms-password-strength-meter',
'description' => ! empty( $block['attrs']['meter_description'] ) ? $block['attrs']['meter_description'] : '',
'min_length' => ! empty( $block['attrs']['html_attrs']['minlength'] ) ? $block['attrs']['html_attrs']['minlength'] : '',
'min_length' => ! empty( $block['attrs']['html_attrs']['minlength'] ) ? max( 6, absint( $block['attrs']['html_attrs']['minlength'] ) ) : '',
'min_strength' => ! empty( $block['attrs']['min_strength'] ) ? $block['attrs']['min_strength'] : '',
'llms_visibility' => ! empty( $block['attrs']['llms_visibility'] ) ? $block['attrs']['llms_visibility'] : '',
'attributes' => array(
Expand Down
30 changes: 29 additions & 1 deletion tests/phpunit/unit-tests/forms/class-llms-test-form-validator.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,8 +296,10 @@ public function test_validate_field_attribute_minlength() {
),
) );

$expected_min = max( 6, $length );

// Too short.
$value = str_repeat( 'A', $length - 1 );
$value = str_repeat( 'A', $expected_min - 1 );
$res = LLMS_Unit_Test_Util::call_method( $this->main, 'validate_field_attribute_minlength', array( $value, $length, $field ) );
$this->assertIsWPError( $res );

Expand Down Expand Up @@ -352,6 +354,32 @@ public function test_validate_field_for_minlength_attribute() {

}

/**
* Test validate_field_attribute_minlength() clamps values below 6 to 6
*
* @since 7.0.4
*
* @return void
*/
public function test_validate_field_attribute_minlength_clamps_to_six() {

$field = $this->get_field_arr( 'password', array(
'attributes' => array(
'minlength' => 1,
),
) );

// 5-character password should be too short because the minimum is clamped to 6.
$res = LLMS_Unit_Test_Util::call_method( $this->main, 'validate_field_attribute_minlength', array( 'short', 1, $field ) );
$this->assertIsWPError( $res );
$this->assertEquals( 'llms-form-field-invalid', $res->get_error_code() );

// 6-character password should pass.
$res = LLMS_Unit_Test_Util::call_method( $this->main, 'validate_field_attribute_minlength', array( 'longer', 1, $field ) );
$this->assertTrue( $res );

}

/**
* Test special validation for the current password field.
*
Expand Down
Loading