Currently, when punctuation is required for a passsword, users can add the GBP symbol (£) and the JS criteria for that constraint disappears (see attached screenshots). However, upon form submission the form error is thrown saying 'Password must contain at least one punctuation (not whitespace or an alphanumeric) character.'

Whilst the PHP function ctype_punct() doesn't recognise '£' as a valid punctuation character, it is possible that users, (at least British users), could and would argue that its not true.

I'm not sure of the 'best' approach to add this in, but I have found that simply adding

|| drupal_substr($password, $i, 1) === '£'

to line 32 of the constraints/constraint_punctuation.inc file resolves this issue.

I would be grateful if this could possibly be added in to the next release of the module please.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

James Byng created an issue. See original summary.

James Hawthorn-Byng’s picture

Issue summary: View changes
shruti1803’s picture

Assigned: Unassigned » shruti1803
AohRveTPV’s picture

Update: This first paragraph is incorrect. The behavior of ctype_punct() depends on the character set in use.

£ is not an ASCII character, and ctype_punct() only considers ASCII characters. To add support for £ in a general way, it seems we would need to add support for Unicode characters.

It is definitely a bug that the JavaScript and PHP aren't behaving consistently. Will try to write a patch to fix.

"Punctuation" seems like misleading terminology to me. Many of the characters for which ctype_punct() would return TRUE are not punctuation grammatically. "Special characters" seems like better terminology, and I see this often on the web so I don't think end users would be too confused by it?

Thank you for the bug report.

AohRveTPV’s picture

Version: 7.x-2.x-dev » 7.x-1.x-dev

7.x-2.x doesn't use ctype_punct(), so I think this bug report should really be against 7.x-1.x.

AohRveTPV’s picture

There seems to be no JavaScript equivalent to ctype_punct(), so I'm not sure how to make the JavaScript punctuation checking behave consistently with the PHP punctuation checking. Suggestions welcome.

AohRveTPV’s picture

Assigned: shruti1803 » Unassigned
Status: Active » Postponed (maintainer needs more info)

I dug into this.

ctype_punct() is locale-aware and does actually recognize the pound symbol as punctuation if the locale is set properly. You can demonstrate this with the following code:

setlocale(LC_ALL, 'en_GB.ISO-8859-1');
var_dump(ctype_punct(utf8_decode('£')));

(That assumes you have the en_GB.ISO-8859-1 locale installed on your system. I had to install it on mine.)

However, Drupal, in bootstrap.inc, sets the locale, overriding whatever locale your system might have set:

  // Set sane locale settings, to ensure consistent string, dates, times and
  // numbers handling.
  setlocale(LC_ALL, 'C');

But you can partially override it in settings.php, like so:

setlocale(LC_CTYPE, 'en_GB.ISO-8859-1');

Then the punctuation constraint will accept the pound symbol as punctuation.

I don't know whether that settings.php change might cause problems with Drupal, would be interested to know. From searching the web, it sounds like doing setlocale(LC_ALL, ...); in settings.php will break dates, so don't do that, use LC_CTYPE instead.

James Byng, if this is still an issue for you, would the settings.php change work as a solution?

James Hawthorn-Byng’s picture

Hi AohRveTPV,
Thanks for looking into this.
Unfortunately when I added setlocale(LC_CTYPE, 'en_GB.ISO-8859-1'); to the end of my settings file, the punctuation error still occurs, even after flushing the cache.
This maybe because I am using shared hosting and it may not have en_GB.ISO-8859-1 locale installed and I also cant figure out if I can add that or not, although the hosting is based in Ireland so you would have thought so.

Still, the only thing that I have found that works has been adding || drupal_substr($password, $i, 1) === '£' and || drupal_substr($password, $i, 1) === '€' to line 32 of the constraints/constraint_punctuation.inc file.

AohRveTPV’s picture

If you have shell access on the shared host, and it is a Unix-like system, you can do locale -a to list all the available locales. There are many locales that count the pound symbol as punctuation--any ISO-8859-1 one should.

I don't think adding the code you're using to the module would be a good solution because there are very many other such characters people might want to add. But the snippet may help someone else who has the same problem and finds this issue.

The punctuation constraint could be rewritten to count any character that is not in the other character sets as "punctuation". But I hesitate to change the behavior of the constraint that much in the stable branch. People may expect that whitespace, Unicode characters, etc. aren't counted as punctuation.

AohRveTPV’s picture

Status: Postponed (maintainer needs more info) » Active

Need to make JS validation consistent with PHP validation, regardless. I thought of a way to do it and will develop a patch.

AohRveTPV’s picture

Opened a separate issue for making PHP and JS validation consistent: #2876719: PHP and JavaScript constraint validation differs.

I will post a patch there that should make the pound symbol handling consistent between PHP and JS.

If you need the pound symbol to work without hacking the code or changing locales, you could consider using the 7.x-2.x alpha. 7.x-2.x defines special characters as the set of all characters minus alphanumeric characters, so that should include the pound symbol.

AohRveTPV’s picture

Status: Active » Closed (won't fix)

The punctuation and character types constraints have been changed in #2876719: PHP and JavaScript constraint validation differs to only count ASCII printable special characters:

`~!@#$%^&*()-_=+[{]};:'",<.>/?

So, special characters in Unicode or special characters that may exist in character sets of other locales are not counted. The reason is I simply don't know a way to obtain an identical list of such special characters in both JavaScript and PHP. If anyone knows one, I am glad to re-open and consider expanding the list of special characters.

7.x-2.x defines special characters as the set of all characters excluding a-z, A-Z, and 0-9. But this seems technically incorrect because a character like À is not a special character, it's alphabetic.

The JavaScript and PHP validation now behave identically in 7.x-1.x-dev.

apaderno’s picture

Issue tags: -punctuation validation, -£