discourse/lib/validators/password_validator.rb

# frozen_string_literal: true

class PasswordValidator < ActiveModel::EachValidator

  def validate_each(record, attribute, value)
    return unless record.password_validation_required?

    if value.nil?
      record.errors.add(attribute, :blank)
    elsif value.length < SiteSetting.min_admin_password_length && (record.admin? || is_developer?(record.email))
      record.errors.add(attribute, :too_short, count: SiteSetting.min_admin_password_length)
    elsif value.length < SiteSetting.min_password_length
      record.errors.add(attribute, :too_short, count: SiteSetting.min_password_length)
    elsif record.username.present? && value == record.username
      record.errors.add(attribute, :same_as_username)
    elsif record.name.present? && value == record.name
      record.errors.add(attribute, :same_as_name)
    elsif record.email.present? && value == record.email
      record.errors.add(attribute, :same_as_email)
    elsif record.confirm_password?(value)
      record.errors.add(attribute, :same_as_current)
    elsif SiteSetting.block_common_passwords && CommonPasswords.common_password?(value)
      record.errors.add(attribute, :common)
    elsif value.chars.uniq.length < SiteSetting.password_unique_characters
      record.errors.add(attribute, :unique_characters)
    end
  end

  def is_developer?(value)
    Rails.configuration.respond_to?(:developer_emails) && Rails.configuration.developer_emails.include?(value)
  end

end
DEV: enable frozen string literal on all files This reduces chances of errors where consumers of strings mutate inputs and reduces memory usage of the app. Test suite passes now, but there may be some stuff left, so we will run a few sites on a branch prior to merging 2019-05-02 18:17:27 -04:00			`# frozen_string_literal: true`

Move password validation into PasswordValidator 2013-12-19 15:12:03 -05:00			`class PasswordValidator < ActiveModel::EachValidator`

			`def validate_each(record, attribute, value)`
FIX: Password required flag should be cleared whenever clearing the raw password (#5384) 2017-11-30 23:19:24 -05:00			`return unless record.password_validation_required?`

Move password validation into PasswordValidator 2013-12-19 15:12:03 -05:00			`if value.nil?`
			`record.errors.add(attribute, :blank)`
FEATURE: enforce admin password validation when signing up via developer email 2016-03-03 13:01:31 -05:00			`elsif value.length < SiteSetting.min_admin_password_length && (record.admin? \|\| is_developer?(record.email))`
FEATURE: new setting min_admin_password_length and better default 2016-03-02 03:31:38 -05:00			`record.errors.add(attribute, :too_short, count: SiteSetting.min_admin_password_length)`
Minimum password length is configurable with the min_password_length site setting. FIX: reset password needs to validate password length. 2013-12-19 16:15:36 -05:00			`elsif value.length < SiteSetting.min_password_length`
			`record.errors.add(attribute, :too_short, count: SiteSetting.min_password_length)`
FEATURE: don't allow username and password to be the same 2015-02-25 11:59:57 -05:00			`elsif record.username.present? && value == record.username`
			`record.errors.add(attribute, :same_as_username)`
FIX: don't allow username to be changed to same as password We were blocking user registrations with same username and password, but allowing usernames to be changed to be same as password later. Also disallow names to be the same as password. 2019-05-13 16:43:19 -04:00			`elsif record.name.present? && value == record.name`
			`record.errors.add(attribute, :same_as_name)`
fixed password validator on equality with email 2016-01-05 15:43:11 -05:00			`elsif record.email.present? && value == record.email`
FEATURE: don't allow username and email to be the same 2015-02-27 13:47:43 -05:00			`record.errors.add(attribute, :same_as_email)`
SECURITY: don't allow re-using the current password during password reset 2016-08-24 12:27:09 -04:00			`elsif record.confirm_password?(value)`
			`record.errors.add(attribute, :same_as_current)`
Block passwords that are in the top 5000 most common passwords. Site setting block_common_passwords can disable this feature. 2013-12-20 16:34:34 -05:00			`elsif SiteSetting.block_common_passwords && CommonPasswords.common_password?(value)`
			`record.errors.add(attribute, :common)`
use chars as opposed to split 2017-02-14 09:40:15 -05:00			`elsif value.chars.uniq.length < SiteSetting.password_unique_characters`
FEATURE: passwords must have a minimum number of unique characters, configurable with a new setting 2017-02-09 15:00:22 -05:00			`record.errors.add(attribute, :unique_characters)`
Move password validation into PasswordValidator 2013-12-19 15:12:03 -05:00			`end`
			`end`

FEATURE: enforce admin password validation when signing up via developer email 2016-03-03 13:01:31 -05:00			`def is_developer?(value)`
			`Rails.configuration.respond_to?(:developer_emails) && Rails.configuration.developer_emails.include?(value)`
			`end`

Move password validation into PasswordValidator 2013-12-19 15:12:03 -05:00			`end`