Follow-up to #2779135: "Delay" constraint allow to change system-generated password

Problem/Motivation

Issue started with problem when user_email_verification setting is ON and on registration user get's system-generated password.
It is important to allow changing password in this case.

Then came to an idea that allowing multiple password changes in a time period is a good follow-up that provides more flexibility.

Proposed resolution

"Delay" constraint extended with a threshold setting, that specifies how many times password can be changed within the set period of time.

CommentFileSizeAuthor
#3 password_policy-7.x-2.x-delay_threshold-2864975-3.patch4.93 KBaohrvetpv
#3 interdiff-2864975-2-3.txt736 bytesaohrvetpv
#2 interdiff-2779135-32-2864975-1.txt1.16 KBl0ke
#2 password_policy-threshold-2864975-1.patch4.93 KBl0ke

Comments

l0ke created an issue. See original summary.

l0ke’s picture

l0ke
Primary language English
Location Ukraine
commented
StatusFileSize
new password_policy-threshold-2864975-1.patch4.93 KB
new interdiff-2779135-32-2864975-1.txt1.16 KB

Follow-up to #2779135-32: "Delay" constraint allow to change system-generated password

  1. +++ b/password_policy.js
@@ -95,8 +95,9 @@
-          return Drupal.t('@delay between changes', {'@delay': delay});
+          return Drupal.t('At most @threshold change(s) in @delay', {'@threshold': threshold, '@delay': delay});

    Nice catch 

  2. +++ b/plugins/constraint/delay.inc
@@ -8,10 +8,11 @@
-  'message' => t('Password cannot be changed within @delay of the last change.'),
+  'message' => t('Password cannot be changed within @delay of the last @threshold change(s).'),

    Nice catch 

  3. +++ b/password_policy.js
@@ -40,7 +40,7 @@
-            Drupal.settings.basePath + cleanUrlPrefix + Drupal.settings.pathPrefix + 'password_policy/check',
+            Drupal.settings.basePath + cleanUrlPrefix + Drupal.settings.pathPrefix + 'password_policy/check' + window.location.search,

    This change is not required for threshold. As was said it needed to pass query parameters for correct handling of password reset. 

  4. +++ b/plugins/constraint/delay.inc
@@ -52,6 +61,15 @@ function password_policy_delay_constraint($password, $account, $constraint) {
+  // If password has been changed fewer times than the threshold, the threshold
+  // cannot be exceeded, so don't apply constraint.

    Nitpick: It is a logical flow so use of "-" sign looks better i think.
    s/than the threshold, the threshold/than the threshold - the threshold

aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new interdiff-2864975-2-3.txt736 bytes
new password_policy-7.x-2.x-delay_threshold-2864975-3.patch4.93 KB

To me the dash makes it less readable. How about we just reorder the wording?

l0ke’s picture

l0ke
Primary language English
Location Ukraine
commented
Status: Needs review » Reviewed & tested by the community

@AohRveTPV Yes, that's perfect.

  • AohRveTPV committed 136cb2f on 7.x-2.x authored by l0ke 
    Issue #2864975 by l0ke, AohRveTPV, BR0kEN: "Delay" constraint add...

AohRveTPV credited BR0kEN.

AohRveTPV credited BR0kEN.

aohrvetpv’s picture

aohrvetpv commented
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.