Skip to content

Commit 642c540

Browse files
author
Kristan Kenney
authored
Merge pull request hestiacp#1035 from hestiacp/fix/07-2020-enforce_password_rules
Enforce min password rules + show hint
2 parents 794d9f0 + 94df6dd commit 642c540

File tree

15 files changed

+264
-85
lines changed

15 files changed

+264
-85
lines changed

‎web/add/db/index.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,7 @@
4242

4343
// Check password length
4444
if (empty($_SESSION['error_msg'])) {
45-
$pw_len = strlen($_POST['v_password']);
46-
if ($pw_len < 6 ) $_SESSION['error_msg'] = __('Password is too short.',$error_msg);
45+
if (!preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$/', $_POST['v_password'])) { $_SESSION['error_msg'] = __('Password does not match the minimum requirements'); }
4746
}
4847

4948
// Protect input

‎web/add/mail/index.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,8 @@
9696
header('location: /login/');
9797
exit();
9898
}
99+
100+
99101

100102
// Check empty fields
101103
if (empty($_POST['v_domain'])) $errors[] = __('domain');
@@ -118,6 +120,11 @@
118120
$_SESSION['error_msg'] = __('Please enter valid email address.');
119121
}
120122
}
123+
124+
// Check password length
125+
if (empty($_SESSION['error_msg']) && !empty($_POST['v_fwd_only']) ) {
126+
if (!preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$/', $_POST['v_password'])) { $_SESSION['error_msg'] = __('Password does not match the minimum requirements'); }
127+
}
121128

122129
// Protect input
123130
$v_domain = escapeshellarg($_POST['v_domain']);

‎web/css/src/styles.css‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3977,12 +3977,18 @@ form#vstobjects.suspended {
39773977
meter {
39783978
/* Reset the default appearance */
39793979
-webkit-appearance: none;
3980-
-moz-appearance: none;
3981-
appearance: none;
3980+
-moz-appearance: none;
3981+
appearance: none;
39823982
margin: 0 auto 1em;
3983-
width: 380px;
3984-
background-color: grey;
3983+
width: 373px;
3984+
background-color: #e7e7e7;
3985+
height: 3px;
3986+
border-bottom-left-radius: 5px;
3987+
border-bottom-right-radius: 5px;
3988+
margin-left: 3px;
3989+
box-shadow: 0px 1px 2px rgba(0,0,0,0.25);
39853990
}
3991+
39863992
meter[value="1"] { background: red; }
39873993
meter[value="2"] { background: orange; }
39883994
meter[value="3"] { background: yellow; }

‎web/css/styles.min.css‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎web/edit/db/index.php‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -63,15 +63,19 @@
6363

6464
// Change database password
6565
if ((!empty($_POST['v_password'])) && (empty($_SESSION['error_msg']))) {
66-
$v_password = tempnam("/tmp","vst");
67-
$fp = fopen($v_password, "w");
68-
fwrite($fp, $_POST['v_password']."\n");
69-
fclose($fp);
70-
exec (HESTIA_CMD."v-change-database-password ".$v_username." ".escapeshellarg($v_database)." ".$v_password, $output, $return_var);
71-
check_return_code($return_var,$output);
72-
unset($output);
73-
unlink($v_password);
74-
$v_password = escapeshellarg($_POST['v_password']);
66+
if (!preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$/', $_POST['v_password'])) {
67+
$_SESSION['error_msg'] = __('Password does not match the minimum requirements');
68+
}else{
69+
$v_password = tempnam("/tmp","vst");
70+
$fp = fopen($v_password, "w");
71+
fwrite($fp, $_POST['v_password']."\n");
72+
fclose($fp);
73+
exec (HESTIA_CMD."v-change-database-password ".$v_username." ".escapeshellarg($v_database)." ".$v_password, $output, $return_var);
74+
check_return_code($return_var,$output);
75+
unset($output);
76+
unlink($v_password);
77+
$v_password = escapeshellarg($_POST['v_password']);
78+
}
7579
}
7680

7781
// Set success message

‎web/edit/mail/index.php‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -398,15 +398,19 @@
398398

399399
// Change password
400400
if ((!empty($_POST['v_password'])) && (empty($_SESSION['error_msg']))) {
401-
$v_password = tempnam("/tmp","vst");
402-
$fp = fopen($v_password, "w");
403-
fwrite($fp, $_POST['v_password']."\n");
404-
fclose($fp);
405-
exec (HESTIA_CMD."v-change-mail-account-password ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".$v_password, $output, $return_var);
406-
check_return_code($return_var,$output);
407-
unset($output);
408-
unlink($v_password);
409-
$v_password = escapeshellarg($_POST['v_password']);;
401+
if (!preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$/', $_POST['v_password'])) {
402+
$_SESSION['error_msg'] = __('Password does not match the minimum requirements');
403+
}else{
404+
$v_password = tempnam("/tmp","vst");
405+
$fp = fopen($v_password, "w");
406+
fwrite($fp, $_POST['v_password']."\n");
407+
fclose($fp);
408+
exec (HESTIA_CMD."v-change-mail-account-password ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".$v_password, $output, $return_var);
409+
check_return_code($return_var,$output);
410+
unset($output);
411+
unlink($v_password);
412+
$v_password = escapeshellarg($_POST['v_password']);
413+
}
410414
}
411415

412416
// Change quota

‎web/js/pages/add_db.js‎

Lines changed: 37 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,19 +63,53 @@ App.Listeners.DB.keypress_db_databasename = function() {
6363
});
6464
}
6565

66+
App.Actions.DB.update_v_password = function (){
67+
var password = $('input[name="v_password"]').val();
68+
var min_small = new RegExp(/^(?=.*[a-z]).+$/);
69+
var min_cap = new RegExp(/^(?=.*[A-Z]).+$/);
70+
var min_num = new RegExp(/^(?=.*\d).+$/);
71+
var min_length = 8;
72+
var score = 0;
73+
74+
if(password.length >= min_length) { score = score + 1; }
75+
if(min_small.test(password)) { score = score + 1;}
76+
if(min_cap.test(password)) { score = score + 1;}
77+
if(min_num.test(password)) { score = score+ 1; }
78+
$('#meter').val(score);
79+
}
80+
81+
App.Listeners.DB.keypress_v_password = function() {
82+
var ref = $('input[name="v_password"]');
83+
ref.bind('keypress input', function(evt) {
84+
clearTimeout(window.frp_usr_tmt);
85+
window.frp_usr_tmt = setTimeout(function() {
86+
var elm = $(evt.target);
87+
App.Actions.DB.update_v_password(elm, $(elm).val());
88+
}, 100);
89+
});
90+
}
91+
92+
App.Listeners.DB.keypress_v_password();
93+
6694
//
6795
// Page entry point
6896
// Trigger listeners
6997
App.Listeners.DB.keypress_db_username();
7098
App.Listeners.DB.keypress_db_databasename();
7199

72-
randomString = function() {
100+
randomString = function(min_length = 16) {
73101
var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz';
74-
var string_length = 16;
102+
var string_length = min_length;
75103
var randomstring = '';
76104
for (var i = 0; i < string_length; i++) {
77105
var rnum = Math.floor(Math.random() * chars.length);
78106
randomstring += chars.substr(rnum, 1);
79107
}
80-
document.v_add_db.v_password.value = randomstring;
108+
var regex = new RegExp(/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*\d)[a-zA-Z\d]{8,}$/);
109+
if(!regex.test(randomstring)){
110+
randomString();
111+
}else{
112+
$('input[name=v_password]').val(randomstring);
113+
App.Actions.DB.update_v_password();
114+
}
81115
}

‎web/js/pages/add_mail_acc.js‎

Lines changed: 43 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -75,22 +75,56 @@ $('form[name="v_quota"]').on('submit', function(evt) {
7575
});
7676
});
7777

78+
App.Actions.MAIL_ACC.update_v_password = function (){
79+
var password = $('input[name="v_password"]').val();
80+
var min_small = new RegExp(/^(?=.*[a-z]).+$/);
81+
var min_cap = new RegExp(/^(?=.*[A-Z]).+$/);
82+
var min_num = new RegExp(/^(?=.*\d).+$/);
83+
var min_length = 8;
84+
var score = 0;
85+
86+
if(password.length >= min_length) { score = score + 1; }
87+
if(min_small.test(password)) { score = score + 1;}
88+
if(min_cap.test(password)) { score = score + 1;}
89+
if(min_num.test(password)) { score = score+ 1; }
90+
$('#meter').val(score);
91+
}
92+
93+
App.Listeners.MAIL_ACC.keypress_v_password = function() {
94+
var ref = $('input[name="v_password"]');
95+
ref.bind('keypress input', function(evt) {
96+
clearTimeout(window.frp_usr_tmt);
97+
window.frp_usr_tmt = setTimeout(function() {
98+
var elm = $(evt.target);
99+
App.Actions.MAIL_ACC.update_v_password(elm, $(elm).val());
100+
}, 100);
101+
});
102+
}
103+
104+
App.Listeners.MAIL_ACC.keypress_v_password();
105+
78106

79-
randomString = function() {
107+
randomString = function(min_length = 16) {
80108
var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz';
81-
var string_length = 16;
109+
var string_length = min_length;
82110
var randomstring = '';
83111
for (var i = 0; i < string_length; i++) {
84112
var rnum = Math.floor(Math.random() * chars.length);
85113
randomstring += chars.substr(rnum, 1);
86114
}
87-
document.v_add_mail_acc.v_password.value = randomstring;
88-
89-
if($('input[name=v_password]').attr('type') == 'text')
90-
$('#v_password').text(randomstring);
91-
else
92-
$('#v_password').text(Array(randomstring.length+1).join('*'));
93-
generate_mail_credentials();
115+
var regex = new RegExp(/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*\d)[a-zA-Z\d]{8,}$/);
116+
if(!regex.test(randomstring)){
117+
randomString();
118+
}else{
119+
$('input[name=v_password]').val(randomstring);
120+
if($('input[name=v_password]').attr('type') == 'text')
121+
$('#v_password').text(randomstring);
122+
else
123+
$('#v_password').text(Array(randomstring.length+1).join('*'));
124+
125+
App.Actions.MAIL_ACC.update_v_password();
126+
generate_mail_credentials();
127+
}
94128
}
95129

96130
generate_mail_credentials = function() {

‎web/js/pages/edit_db.js‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,20 +63,55 @@ App.Listeners.DB.keypress_db_databasename = function() {
6363
});
6464
}
6565

66+
App.Actions.DB.update_v_password = function (){
67+
var password = $('input[name="v_password"]').val();
68+
var min_small = new RegExp(/^(?=.*[a-z]).+$/);
69+
var min_cap = new RegExp(/^(?=.*[A-Z]).+$/);
70+
var min_num = new RegExp(/^(?=.*\d).+$/);
71+
var min_length = 8;
72+
var score = 0;
73+
74+
if(password.length >= min_length) { score = score + 1; }
75+
if(min_small.test(password)) { score = score + 1;}
76+
if(min_cap.test(password)) { score = score + 1;}
77+
if(min_num.test(password)) { score = score+ 1; }
78+
$('#meter').val(score);
79+
}
80+
81+
App.Listeners.DB.keypress_v_password = function() {
82+
var ref = $('input[name="v_password"]');
83+
ref.bind('keypress input', function(evt) {
84+
clearTimeout(window.frp_usr_tmt);
85+
window.frp_usr_tmt = setTimeout(function() {
86+
var elm = $(evt.target);
87+
App.Actions.DB.update_v_password(elm, $(elm).val());
88+
}, 100);
89+
});
90+
}
91+
92+
App.Listeners.DB.keypress_v_password();
93+
6694
//
6795
// Page entry point
6896
// Trigger listeners
6997
App.Listeners.DB.keypress_db_username();
7098
App.Listeners.DB.keypress_db_databasename();
7199

72-
randomString = function() {
100+
randomString = function(min_length = 16) {
73101
var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz';
74-
var string_length = 16;
102+
var string_length = min_length;
75103
var randomstring = '';
76104
for (var i = 0; i < string_length; i++) {
77105
var rnum = Math.floor(Math.random() * chars.length);
78106
randomstring += chars.substr(rnum, 1);
79107
}
80-
document.v_edit_db.v_password.value = randomstring;
108+
var regex = new RegExp(/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*\d)[a-zA-Z\d]{8,}$/);
109+
if(!regex.test(randomstring)){
110+
randomString();
111+
}else{
112+
$('input[name=v_password]').val(randomstring);
113+
App.Actions.DB.update_v_password();
114+
}
81115
}
116+
82117

‎web/js/pages/edit_mail_acc.js‎

Lines changed: 39 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -53,47 +53,57 @@ App.Listeners.MAIL_ACC.init = function() {
5353
});
5454
}
5555

56-
App.Helpers.isUnlimitedValue = function(value) {
57-
var value = value.trim();
58-
if (value == App.Constants.UNLIM_VALUE || value == App.Constants.UNLIM_TRANSLATED_VALUE) {
59-
return true;
60-
}
61-
62-
return false;
56+
App.Actions.MAIL_ACC.update_v_password = function (){
57+
var password = $('input[name="v_password"]').val();
58+
var min_small = new RegExp(/^(?=.*[a-z]).+$/);
59+
var min_cap = new RegExp(/^(?=.*[A-Z]).+$/);
60+
var min_num = new RegExp(/^(?=.*\d).+$/);
61+
var min_length = 8;
62+
var score = 0;
63+
64+
if(password.length >= min_length) { score = score + 1; }
65+
if(min_small.test(password)) { score = score + 1;}
66+
if(min_cap.test(password)) { score = score + 1;}
67+
if(min_num.test(password)) { score = score+ 1; }
68+
$('#meter').val(score);
6369
}
6470

65-
//
66-
// Page entry point
67-
// Trigger listeners
68-
App.Listeners.MAIL_ACC.init();
69-
App.Listeners.MAIL_ACC.checkbox_unlimited_feature();
70-
$('form[name="v_quota"]').on('submit', function(evt) {
71-
$('input:disabled').each(function(i, elm) {
72-
$(elm).attr('disabled', false);
73-
if (App.Helpers.isUnlimitedValue($(elm).val())) {
74-
$(elm).val(App.Constants.UNLIM_VALUE);
75-
}
71+
App.Listeners.MAIL_ACC.keypress_v_password = function() {
72+
var ref = $('input[name="v_password"]');
73+
ref.bind('keypress input', function(evt) {
74+
clearTimeout(window.frp_usr_tmt);
75+
window.frp_usr_tmt = setTimeout(function() {
76+
var elm = $(evt.target);
77+
App.Actions.MAIL_ACC.update_v_password(elm, $(elm).val());
78+
}, 100);
7679
});
77-
});
80+
}
81+
82+
App.Listeners.MAIL_ACC.keypress_v_password();
7883

7984

80-
randomString = function() {
85+
randomString = function(min_length = 16) {
8186
var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz';
82-
var string_length = 16;
87+
var string_length = min_length;
8388
var randomstring = '';
8489
for (var i = 0; i < string_length; i++) {
8590
var rnum = Math.floor(Math.random() * chars.length);
8691
randomstring += chars.substr(rnum, 1);
8792
}
88-
document.v_edit_mail_acc.v_password.value = randomstring;
89-
90-
if($('input[name=v_password]').attr('type') == 'text')
91-
$('#v_password').text(randomstring);
92-
else
93-
$('#v_password').text(Array(randomstring.length+1).join('*'));
94-
generate_mail_credentials();
93+
var regex = new RegExp(/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*\d)[a-zA-Z\d]{8,}$/);
94+
if(!regex.test(randomstring)){
95+
randomString();
96+
}else{
97+
$('input[name=v_password]').val(randomstring);
98+
if($('input[name=v_password]').attr('type') == 'text')
99+
$('#v_password').text(randomstring);
100+
else
101+
$('#v_password').text(Array(randomstring.length+1).join('*'));
102+
103+
App.Actions.MAIL_ACC.update_v_password();
104+
generate_mail_credentials();
105+
}
95106
}
96-
97107
generate_mail_credentials = function() {
98108
var div = $('.mail-infoblock').clone();
99109
div.find('#mail_configuration').remove();

0 commit comments

Comments
 (0)