| Index: trunk/phase3/maintenance/language/messages.inc |
| — | — | @@ -430,6 +430,7 @@ |
| 431 | 431 | 'wrongpasswordempty', |
| 432 | 432 | 'passwordtooshort', |
| 433 | 433 | 'password-name-match', |
| | 434 | + 'password-too-weak', |
| 434 | 435 | 'mailmypassword', |
| 435 | 436 | 'passwordremindertitle', |
| 436 | 437 | 'passwordremindertext', |
| Index: trunk/phase3/includes/User.php |
| — | — | @@ -601,18 +601,22 @@ |
| 602 | 602 | * @return mixed: true on success, string of error message on failure |
| 603 | 603 | */ |
| 604 | 604 | function getPasswordValidity( $password ) { |
| 605 | | - global $wgMinimalPasswordLength, $wgContLang; |
| | 605 | + global $wgMinimalPasswordLength, $wgWeakPasswords, $wgContLang; |
| 606 | 606 | |
| 607 | 607 | $result = false; //init $result to false for the internal checks |
| 608 | 608 | |
| 609 | 609 | if( !wfRunHooks( 'isValidPassword', array( $password, &$result, $this ) ) ) |
| 610 | 610 | return $result; |
| 611 | 611 | |
| | 612 | + $lcPassword = $wgContLang->lc( $password ); |
| | 613 | + |
| 612 | 614 | if ( $result === false ) { |
| 613 | 615 | if( strlen( $password ) < $wgMinimalPasswordLength ) { |
| 614 | 616 | return 'passwordtooshort'; |
| 615 | | - } elseif ( $wgContLang->lc( $password ) == $wgContLang->lc( $this->mName ) ) { |
| | 617 | + } elseif ( $lcPassword == $wgContLang->lc( $this->mName ) ) { |
| 616 | 618 | return 'password-name-match'; |
| | 619 | + } elseif ( in_array( $lcPassword, $wgWeakPasswords ) ) { |
| | 620 | + return 'password-too-weak'; |
| 617 | 621 | } else { |
| 618 | 622 | //it seems weird returning true here, but this is because of the |
| 619 | 623 | //initialization of $result to false above. If the hook is never run or it |
| Index: trunk/phase3/includes/DefaultSettings.php |
| — | — | @@ -2771,6 +2771,12 @@ |
| 2772 | 2772 | $wgLivePasswordStrengthChecks = false; |
| 2773 | 2773 | |
| 2774 | 2774 | /** |
| | 2775 | + * List of weak passwords which shouldn't be allowed. |
| | 2776 | + * The items should be in lowercase. The check is case insensitive. |
| | 2777 | + */ |
| | 2778 | +$wgWeakPasswords = array( 'password', 'passpass', 'passpass1' ); |
| | 2779 | + |
| | 2780 | +/** |
| 2775 | 2781 | * Maximum number of Unicode characters in signature |
| 2776 | 2782 | */ |
| 2777 | 2783 | $wgMaxSigChars = 255; |
| Index: trunk/phase3/languages/messages/MessagesEn.php |
| — | — | @@ -1085,6 +1085,7 @@ |
| 1086 | 1086 | Please try again.', |
| 1087 | 1087 | 'passwordtooshort' => 'Passwords must be at least {{PLURAL:$1|1 character|$1 characters}}.', |
| 1088 | 1088 | 'password-name-match' => 'Your password must be different from your username.', |
| | 1089 | +'password-too-weak' => 'The provided password is too weak and cannot be used.', |
| 1089 | 1090 | 'mailmypassword' => 'E-mail new password', |
| 1090 | 1091 | 'passwordremindertitle' => 'New temporary password for {{SITENAME}}', |
| 1091 | 1092 | 'passwordremindertext' => 'Someone (probably you, from IP address $1) requested a new |