Currently, when punctuation is required for a passsword, users can add the GBP symbol (£) and the JS criteria for that constraint disappears (see attached screenshots). However, upon form submission the form error is thrown saying 'Password must contain at least one punctuation (not whitespace or an alphanumeric) character.'
Whilst the PHP function ctype_punct() doesn't recognise '£' as a valid punctuation character, it is possible that users, (at least British users), could and would argue that its not true.
I'm not sure of the 'best' approach to add this in, but I have found that simply adding
|| drupal_substr($password, $i, 1) === '£'
to line 32 of the constraints/constraint_punctuation.inc file resolves this issue.
I would be grateful if this could possibly be added in to the next release of the module please.
Comment | File | Size | Author |
---|---|---|---|
with-punctuation.png | 9.55 KB | James Hawthorn-Byng | |
without-punctuation.png | 16.6 KB | James Hawthorn-Byng |
Comments
Comment #2
James Hawthorn-Byng CreditAttribution: James Hawthorn-Byng commentedComment #3
shruti1803 CreditAttribution: shruti1803 at Iksula commentedComment #4
AohRveTPV CreditAttribution: AohRveTPV commentedUpdate: This first paragraph is incorrect. The behavior of ctype_punct() depends on the character set in use.
£ is not an ASCII character, and
ctype_punct()
only considers ASCII characters. To add support for £ in a general way, it seems we would need to add support for Unicode characters.It is definitely a bug that the JavaScript and PHP aren't behaving consistently. Will try to write a patch to fix.
"Punctuation" seems like misleading terminology to me. Many of the characters for which
ctype_punct()
would return TRUE are not punctuation grammatically. "Special characters" seems like better terminology, and I see this often on the web so I don't think end users would be too confused by it?Thank you for the bug report.
Comment #5
AohRveTPV CreditAttribution: AohRveTPV commented7.x-2.x doesn't use
ctype_punct()
, so I think this bug report should really be against 7.x-1.x.Comment #6
AohRveTPV CreditAttribution: AohRveTPV commentedThere seems to be no JavaScript equivalent to
ctype_punct()
, so I'm not sure how to make the JavaScript punctuation checking behave consistently with the PHP punctuation checking. Suggestions welcome.Comment #7
AohRveTPV CreditAttribution: AohRveTPV commentedI dug into this.
ctype_punct()
is locale-aware and does actually recognize the pound symbol as punctuation if the locale is set properly. You can demonstrate this with the following code:(That assumes you have the en_GB.ISO-8859-1 locale installed on your system. I had to install it on mine.)
However, Drupal, in bootstrap.inc, sets the locale, overriding whatever locale your system might have set:
But you can partially override it in settings.php, like so:
Then the punctuation constraint will accept the pound symbol as punctuation.
I don't know whether that settings.php change might cause problems with Drupal, would be interested to know. From searching the web, it sounds like doing
setlocale(LC_ALL, ...);
in settings.php will break dates, so don't do that, use LC_CTYPE instead.James Byng, if this is still an issue for you, would the settings.php change work as a solution?
Comment #8
James Hawthorn-Byng CreditAttribution: James Hawthorn-Byng commentedHi AohRveTPV,
Thanks for looking into this.
Unfortunately when I added setlocale(LC_CTYPE, 'en_GB.ISO-8859-1'); to the end of my settings file, the punctuation error still occurs, even after flushing the cache.
This maybe because I am using shared hosting and it may not have en_GB.ISO-8859-1 locale installed and I also cant figure out if I can add that or not, although the hosting is based in Ireland so you would have thought so.
Still, the only thing that I have found that works has been adding
|| drupal_substr($password, $i, 1) === '£'
and|| drupal_substr($password, $i, 1) === '€'
to line 32 of the constraints/constraint_punctuation.inc file.Comment #9
AohRveTPV CreditAttribution: AohRveTPV commentedIf you have shell access on the shared host, and it is a Unix-like system, you can do
locale -a
to list all the available locales. There are many locales that count the pound symbol as punctuation--any ISO-8859-1 one should.I don't think adding the code you're using to the module would be a good solution because there are very many other such characters people might want to add. But the snippet may help someone else who has the same problem and finds this issue.
The punctuation constraint could be rewritten to count any character that is not in the other character sets as "punctuation". But I hesitate to change the behavior of the constraint that much in the stable branch. People may expect that whitespace, Unicode characters, etc. aren't counted as punctuation.
Comment #10
AohRveTPV CreditAttribution: AohRveTPV commentedNeed to make JS validation consistent with PHP validation, regardless. I thought of a way to do it and will develop a patch.
Comment #11
AohRveTPV CreditAttribution: AohRveTPV commentedOpened a separate issue for making PHP and JS validation consistent: #2876719: PHP and JavaScript constraint validation differs.
I will post a patch there that should make the pound symbol handling consistent between PHP and JS.
If you need the pound symbol to work without hacking the code or changing locales, you could consider using the 7.x-2.x alpha. 7.x-2.x defines special characters as the set of all characters minus alphanumeric characters, so that should include the pound symbol.
Comment #12
AohRveTPV CreditAttribution: AohRveTPV commentedThe punctuation and character types constraints have been changed in #2876719: PHP and JavaScript constraint validation differs to only count ASCII printable special characters:
So, special characters in Unicode or special characters that may exist in character sets of other locales are not counted. The reason is I simply don't know a way to obtain an identical list of such special characters in both JavaScript and PHP. If anyone knows one, I am glad to re-open and consider expanding the list of special characters.
7.x-2.x defines special characters as the set of all characters excluding a-z, A-Z, and 0-9. But this seems technically incorrect because a character like
À
is not a special character, it's alphabetic.The JavaScript and PHP validation now behave identically in 7.x-1.x-dev.
Comment #13
apaderno