So, I did some initial digging into this and the following description is my understanding so far.
For config, I have each of the following set to: "Yes":
Replace Registration Page URL to Forum Registration Page URL Replace Login Page URL to Forum Login Page URL Replace Reset Password Page URL to Forum Reset Password Page URL
It looks like there are multiple independent wpForo code paths for setting or changing a password and it doesn't seems that there is a unifying way to control password min and max pass length.
Example 1) -- User Account Change Password form:
- The controlling code in this use case appears to be classes/Members.php public function init_fields():
... $this->fields['user_pass'] = [ ... 'description' => wpforo_phrase( 'Must be minimum 6 characters.', false ), 'minLength' => 6, 'maxLength' => 20, ... ]
- The description, minLength, maxLength params control what the html input validation that the user experiences on the front end.
- The example fields above yield html code with matching minlength and maxlength validation params:
<input type="password" name="member[user_pass1]" value="" id="member_user_pass_6456f90540d1c-new1" class="member_user_pass_6456f90540d1c" placeholder="New password" autocomplete="off" minlength="6" maxlength="20">
- If I manually change the minLength and maxLength php definitions here, I can successfully get the password validation the way I would like it for this particular scenario. I can change the description via the phrases page mentioned above.
- There does not appear to be a filter to hook into to set these values, for example, from a WPCode snippet.
- There also does not appear to be php password min and max length validation -- only a reliance on this html input validation.
Example 2) -- Initial registration process:
- The controlling code in this use case appears to be classes/Members.php function create( $data )
- In this function, I can verify that during new user registration when the new user and email are supplied and the form is submitted that the WPCode snippet sets min and max length from the apply_filter mentioned in the previous post. We can see where it gets applied in the create function code here:
$this->login_min_length = apply_filters( 'wpforo_login_min_length', $this->login_min_length ); $this->login_max_length = apply_filters( 'wpforo_login_max_length', $this->login_max_length );
- A little further down in this function's code, there is this elseif which appears that it utilizes this login_[min|max]_length and should enforce it:
elseif( strlen( $user_pass1 ) < $this->pass_min_length || strlen( $user_pass1 ) > $this->pass_max_length ) { WPF()->notice->add( 'Password length must be between %d characters and %d characters.', 'error', [ $this->pass_min_length, $this->pass_max_length ] );
- But I don't experience that: immediately after submitting the username and user email for registration, the new user gets an email to set a new password with a link, which when followed, allows the user to set the default min of 6 characters regardless of observing that login_min_length was set to something larger during the initial user form submission. I suppose that means login_min_length is not getting set properly by wpforo_login_min_length on the password reset page itself; I'm not sure why yet.
Example 3) -- $FQDN/change-password
- The controlling code in this use case appears to be classes/Members.php function update( ... )
- In this function, there is a change password function called:
if( $result_password && wpfval( $user, 'old_pass' ) && wpfval( $user, 'user_pass1' ) ) { $result_password = $this->change_password( $user['old_pass'], $user['user_pass1'], $userid ); }
- And in the change password function, it looks like there is possibly a way to validate a min and max length by adding a filter on `wpforo_change_password_validate`, which I don't see any code utilizing anywhere:
if( ! apply_filters( 'wpforo_change_password_validate', true, $old_passw, $new_passw, $user ) ) return false;
- It seems, though, that setting [min|max]Length and/or wpforo_login_[min|max]_length params mentioned above have no effect here either.
So, hopefully I've missed or misunderstood a few things here which can be pointed out...
I am really looking to get a consistent user experience with password min and max lengths across each of the methods a user can choose to set or change their password. From what I see so far, it looks like there are several different mechanisms to try to accomplish this, and it's not clear to me how I could easily go about doing that.
Ideally, there could be a single set of apply_filter params, like the one mentioned in the previous post above, that would get applied consistently across each of these password set/reset use cases: new registration, $FQDN/change-password, and user account UI password reset:
<?php add_filter('wpforo_pass_min_length', function ($length){ return 16; } ); add_filter('wpforo_pass_max_length', function ($length){ return 48; } ); ?>
Appreciate any feedback, thank you.
Thanks @Chris... I'll follow up with that... It also looks like I can do some custom php coding using the wpForo hooks to add additional complexity requirements (ex: sample code).
Yes, understood. At some point in the future, it would be great if wpforo adds a feature for password complexity configuration at which point I'll happily drop the customization that I'd rather not have.