Skip to content

Commit 1dbb4d7

Browse files
jaapmarcusjaapmarcus
committed
hestiacp#1032 Min password length missing
Closes hestiacp#1032, hestiacp#1031 and hestiacp#1027 Enforces minumum password length of 8 char and specific format Added "visiual indicator for requirements password" Enforces minum length of name same as /add/user/ Added checkbox to block copie email to notify box Css files in header Synced cache method with .js files
1 parent 0727ef9 commit 1dbb4d7

File tree

10 files changed

+179
-31
lines changed

10 files changed

+179
-31
lines changed

‎web/add/user/index.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,7 @@
4545

4646
// Check password length
4747
if (empty($_SESSION['error_msg'])) {
48-
$pw_len = strlen($_POST['v_password']);
49-
if ($pw_len < 6 ) $_SESSION['error_msg'] = __('Password is too short.',$error_msg);
48+
if (!preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$/', $_POST['v_password'])) { $_SESSION['error_msg'] = __('Password does not match the minimum requirements'); }
5049
}
5150

5251
// Protect input

‎web/css/src/styles.css‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3973,3 +3973,29 @@ form#vstobjects.suspended {
39733973
display: none;
39743974
}
39753975
}
3976+
3977+
meter {
3978+
/* Reset the default appearance */
3979+
-webkit-appearance: none;
3980+
-moz-appearance: none;
3981+
appearance: none;
3982+
margin: 0 auto 1em;
3983+
width: 380px;
3984+
background-color: grey;
3985+
}
3986+
meter[value="1"] { background: red; }
3987+
meter[value="2"] { background: orange; }
3988+
meter[value="3"] { background: yellow; }
3989+
meter[value="4"] { background: green; }
3990+
3991+
/* Webkit based browsers */
3992+
meter[value="1"]::-webkit-meter-optimum-value { background: red; }
3993+
meter[value="2"]::-webkit-meter-optimum-value { background: orange; }
3994+
meter[value="3"]::-webkit-meter-optimum-value { background: yellow; }
3995+
meter[value="4"]::-webkit-meter-optimum-value { background: green; }
3996+
3997+
/* Gecko based browsers */
3998+
meter[value="1"]::-moz-meter-bar { background: red; }
3999+
meter[value="2"]::-moz-meter-bar { background: orange; }
4000+
meter[value="3"]::-moz-meter-bar { background: yellow; }
4001+
meter[value="4"]::-moz-meter-bar { background: green; }

‎web/css/styles.min.css‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎web/edit/user/index.php‎

Lines changed: 23 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -98,15 +98,20 @@
9898

9999
// Change password
100100
if ((!empty($_POST['v_password'])) && (empty($_SESSION['error_msg']))) {
101-
$v_password = tempnam("/tmp","vst");
102-
$fp = fopen($v_password, "w");
103-
fwrite($fp, $_POST['v_password']."\n");
104-
fclose($fp);
105-
exec (HESTIA_CMD."v-change-user-password ".escapeshellarg($v_username)." ".$v_password, $output, $return_var);
106-
check_return_code($return_var,$output);
107-
unset($output);
108-
unlink($v_password);
109-
$v_password = escapeshellarg($_POST['v_password']);
101+
// Check password length
102+
$pw_len = strlen($_POST['v_password']);
103+
if (!preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$/', $_POST['v_password'])) { $_SESSION['error_msg'] = __('Password does not match the minimum requirements'); }
104+
if (empty($_SESSION['error_msg'])) {
105+
$v_password = tempnam("/tmp","vst");
106+
$fp = fopen($v_password, "w");
107+
fwrite($fp, $_POST['v_password']."\n");
108+
fclose($fp);
109+
exec (HESTIA_CMD."v-change-user-password ".escapeshellarg($v_username)." ".$v_password, $output, $return_var);
110+
check_return_code($return_var,$output);
111+
unset($output);
112+
unlink($v_password);
113+
$v_password = escapeshellarg($_POST['v_password']);
114+
}
110115
}
111116

112117
// Enable twofa
@@ -184,11 +189,15 @@
184189

185190
// Change full name
186191
if ($v_name != $_POST['v_name']){
187-
$v_name = escapeshellarg($_POST['v_name']);
188-
exec (HESTIA_CMD."v-change-user-name ".escapeshellarg($v_username). " ". "$v_name", $output, $return_var);
189-
check_return_code($return_var,$output);
190-
unset($output);
191-
$v_name = $_POST['v_name'];
192+
if (empty($_POST['v_name'])) {
193+
$_SESSION['error_msg'] = __('Please enter a valid name');
194+
}else{
195+
$v_name = escapeshellarg($_POST['v_name']);
196+
exec (HESTIA_CMD."v-change-user-name ".escapeshellarg($v_username). " ".$v_name, $output, $return_var);
197+
check_return_code($return_var,$output);
198+
unset($output);
199+
$v_name = $_POST['v_name'];
200+
}
192201
}
193202

194203
// Change NameServers

‎web/js/pages/add_user.js‎

Lines changed: 47 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,60 @@
11
$(function() {
22
$('#v_email').change(function() {
3-
document.getElementById('v_notify').value = document.getElementById('v_email').value;
3+
if($('#v_email_notify').attr('checked')){
4+
document.getElementById('v_notify').value = document.getElementById('v_email').value;
5+
}
46
});
7+
$('#v_email_notify').change(function() {
8+
if($('#v_email_notify').attr('checked')){
9+
document.getElementById('v_notify').value = document.getElementById('v_email').value;
10+
}else{
11+
document.getElementById('v_notify').value = '';
12+
}
13+
});
514
});
615

716

8-
randomString = function() {
17+
randomString = function(min_length = 16) {
918
var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz';
10-
var string_length = 16;
19+
var string_length = min_length;
1120
var randomstring = '';
1221
for (var i = 0; i < string_length; i++) {
1322
var rnum = Math.floor(Math.random() * chars.length);
1423
randomstring += chars.substr(rnum, 1);
1524
}
16-
document.v_add_user.v_password.value = randomstring;
25+
var regex = new RegExp(/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*\d)[a-zA-Z\d]{8,}$/);
26+
if(!regex.test(randomstring)){
27+
randomString();
28+
}else{
29+
$('input[name=v_password]').val(randomstring);
30+
App.Actions.WEB.update_v_password();
31+
}
1732
}
33+
34+
App.Actions.WEB.update_v_password = function (){
35+
var password = $('input[name="v_password"]').val();
36+
var min_small = new RegExp(/^(?=.*[a-z]).+$/);
37+
var min_cap = new RegExp(/^(?=.*[A-Z]).+$/);
38+
var min_num = new RegExp(/^(?=.*\d).+$/);
39+
var min_length = 8;
40+
var score = 0;
41+
42+
if(password.length >= min_length) { score = score + 1; }
43+
if(min_small.test(password)) { score = score + 1;}
44+
if(min_cap.test(password)) { score = score + 1;}
45+
if(min_num.test(password)) { score = score+ 1; }
46+
$('#meter').val(score);
47+
}
48+
49+
App.Listeners.WEB.keypress_v_password = function() {
50+
var ref = $('input[name="v_password"]');
51+
ref.bind('keypress input', function(evt) {
52+
clearTimeout(window.frp_usr_tmt);
53+
window.frp_usr_tmt = setTimeout(function() {
54+
var elm = $(evt.target);
55+
App.Actions.WEB.update_v_password(elm, $(elm).val());
56+
}, 100);
57+
});
58+
}
59+
60+
App.Listeners.WEB.keypress_v_password();

‎web/js/pages/edit_user.js‎

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,46 @@
1-
function randomString() {
1+
randomString = function(min_length = 16) {
22
var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz';
3-
var string_length = 16;
3+
var string_length = min_length;
44
var randomstring = '';
55
for (var i = 0; i < string_length; i++) {
66
var rnum = Math.floor(Math.random() * chars.length);
77
randomstring += chars.substr(rnum, 1);
88
}
9-
document.v_edit_user.v_password.value = randomstring;
9+
var regex = new RegExp(/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*\d)[a-zA-Z\d]{8,}$/);
10+
if(!regex.test(randomstring)){
11+
randomString();
12+
}else{
13+
$('input[name=v_password]').val(randomstring);
14+
}
1015
}
1116

17+
App.Actions.WEB.update_v_password = function (){
18+
var password = $('input[name="v_password"]').val();
19+
var min_small = new RegExp(/^(?=.*[a-z]).+$/);
20+
var min_cap = new RegExp(/^(?=.*[A-Z]).+$/);
21+
var min_num = new RegExp(/^(?=.*\d).+$/);
22+
var min_length = 8;
23+
var score = 0;
24+
if(password.length >= min_length) { score = score + 1; }
25+
if(min_small.test(password)) { score = score + 1;}
26+
if(min_cap.test(password)) { score = score + 1;}
27+
if(min_num.test(password)) { score = score+ 1; }
28+
$('#meter').val(score);
29+
}
30+
31+
App.Listeners.WEB.keypress_v_password = function() {
32+
var ref = $('input[name="v_password"]');
33+
ref.bind('keypress input', function(evt) {
34+
clearTimeout(window.frp_usr_tmt);
35+
window.frp_usr_tmt = setTimeout(function() {
36+
var elm = $(evt.target);
37+
App.Actions.WEB.update_v_password(elm, $(elm).val());
38+
}, 100);
39+
});
40+
}
41+
App.Listeners.WEB.keypress_v_password();
42+
43+
1244
$(document).ready(function(){
1345
$('.add-ns-button').click(function(){
1446
var n = $('input[name^=v_ns]').length;

‎web/templates/admin/add_user.html‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,18 @@
6868
</tr>
6969
<tr>
7070
<td>
71-
<input type="text" size="20" class="vst-input password" name="v_password" value="<?=htmlentities(trim($v_password, "'"))?>" tabindex="2" >
71+
<input type="text" size="20" class="vst-input password" name="v_password" value="<?=htmlentities(trim($v_password, "'"))?>" tabindex="2" /><br />
72+
<meter max="4" id="meter"></meter>
73+
</td>
74+
</tr>
75+
<tr>
76+
<td class="vst-text">
77+
<p><?php print('Your password must have at least');?></p>
78+
<ul>
79+
<li><?php print('8 characters long');?></li>
80+
<li><?php print('1 uppercase & 1 lowercase character');?></li>
81+
<li><?php print('1 number');?></li>
82+
</ul>
7283
</td>
7384
</tr>
7485
<tr>
@@ -90,6 +101,11 @@
90101
<td>
91102
<input type="text" size="20" class="vst-input" name="v_email" id='v_email' value="<?=htmlentities(trim($v_email, "'"))?>" tabindex="5" >
92103
</td>
104+
</tr>
105+
<tr>
106+
<td>
107+
<label><input type="checkbox" size="20" class="vst-checkbox" name="v_email_notice" id='v_email_notify' value="" tabindex="5" /> <?php print __('Send welcome email');?></label>
108+
</td>
93109
</tr>
94110
<tr>
95111
<td class="vst-text input-label" name="v_package">

‎web/templates/admin/edit_user.html‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,21 @@
7373
</tr>
7474
<tr>
7575
<td>
76-
<input type="text" size="20" class="vst-input password" name="v_password" value="<?=htmlentities(trim($v_password, "'"))?>">
76+
<input type="text" size="20" class="vst-input password" name="v_password" value="<?=htmlentities(trim($v_password, "'"))?>"><br />
77+
<meter max="4" id="meter"></meter>
7778
</td>
7879
</tr>
80+
<tr>
81+
<td class="vst-text">
82+
<p id="password-strength-text"></p>
83+
<p><?php print('Your password must have at least');?></p>
84+
<ul>
85+
<li><?php print('8 characters long');?></li>
86+
<li><?php print('1 uppercase & 1 lowercase character');?></li>
87+
<li><?php print('1 number');?></li>
88+
</ul>
89+
</td>
90+
</tr>
7991
<tr>
8092
<td>
8193
<label><input type="checkbox" class="vst-checkbox password-option" name="v_twofa" <?php if(!empty($v_twofa)) echo "checked=yes" ?>> <?php print __('Enable 2FA');?></label>

‎web/templates/header.html‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
<meta charset="utf-8">
55
<link rel="icon" href="/images/favicon.ico" type="image/x-icon">
66
<title><?php echo $_SERVER['HTTP_HOST']; ?> - <?=__($TAB)?> - <?=__('Hestia Control Panel');?></title>
7-
<link type="text/css" rel="stylesheet" href="/css/styles.min.css?1446554106" />
7+
<link type="text/css" rel="stylesheet" href="/css/styles.min.css?<?php echo JS_LATEST_UPDATE; ?>" />
88
<link type="text/css" rel="stylesheet" href="/css/active-theme.css?<?php echo rand(); ?>" />
9-
<link type="text/css" href="/css/animate.min.css?1446554103" rel="stylesheet" />
10-
<link type="text/css" href="/css/jquery-custom-dialogs.css?1446554103" rel="stylesheet" />
11-
<link type="text/css" href="/css/all.min.css?1446554103" rel="stylesheet" />
9+
<link type="text/css" href="/css/animate.min.css?<?php echo JS_LATEST_UPDATE; ?>" rel="stylesheet" />
10+
<link type="text/css" href="/css/jquery-custom-dialogs.css?<?php echo JS_LATEST_UPDATE; ?>" rel="stylesheet" />
11+
<link type="text/css" href="/css/all.min.css?<?php echo JS_LATEST_UPDATE; ?>" rel="stylesheet" />
1212
<script src="/inc/jquery/jquery-3.4.1.min.js"></script>
1313
<script>
1414
//

‎web/templates/user/edit_user.html‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,20 @@
7373
</tr>
7474
<tr>
7575
<td>
76-
<input type="text" size="20" class="vst-input password" name="v_password" value="<?=htmlentities(trim($v_password, "'"))?>">
76+
<input type="text" size="20" class="vst-input password" name="v_password" value="<?=htmlentities(trim($v_password, "'"))?>"><br />
77+
<meter max="4" id="meter"></meter>
7778
</td>
7879
</tr>
80+
<tr>
81+
<td class="vst-text">
82+
<p><?php print('Your password must have at least');?></p>
83+
<ul>
84+
<li><?php print('8 characters long');?></li>
85+
<li><?php print('1 uppercase & 1 lowercase character');?></li>
86+
<li><?php print('1 number');?></li>
87+
</ul>
88+
</td>
89+
</tr>
7990
<tr>
8091
<td>
8192
<label><input type="checkbox" class="vst-checkbox password-option" name="v_twofa" <?php if(!empty($v_twofa)) echo "checked=yes" ?>> <?php print __('Enable 2FA');?></label>

0 commit comments

Comments
 (0)