Actions
Feature #37279
closed
Reject passwords that are the same as login, first name, last name, or email
Start date:
Due date:
% Done:
0%
Estimated time:
Resolution:
Fixed
Description
Some lazy users may use their login IDs or their names as passwords. This can be a security threat.
Such passwords should always be rejected.
Files
Updated by Go MAEDA almost 2 years ago
- File 37279.patch added
The attached patch adds User#test_validate_password_complexity. It rejects passwords that are the same as the user's login, first name, last name, or email for now. I think it would be great if the method is extended to also reject passwords with dictionary words in the future.
Updated by Go MAEDA about 1 month ago
- Subject changed from Reject passwords that are the same as login, first name, or last name to Reject passwords that are the same as login, first name, last name, or email
- Target version set to 6.0.0
Setting the target version to 6.0.0.
Actions