The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.When logging in on systems running PHP7 or greater, if the warning threshold number is set to an empty string as is the default and as is described in the documentation as the proper value, the module will error because PHP attempts to multiple the empty string by valid numbers. This can be fixed by setting the warning threshold to '0' but some checks in the module code could suppress this.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | password-policy-invalid-number-2895670.patch | 744 bytes | lliss |
Comments
Comment #2
lliss commentedComment #3
lliss commentedComment #4
aohrvetpv commentedThank you for the bug report and patch. I can't think of a better solution than you've provided.
Other possibilities:
- We could add validation to disallow a blank entry for "Password Expiration Warning". But that would create an inconsistency with other configuration form fields where you can use a blank entry to disable the associated functionality.
- We could convert blank entries to 0 upon saving the form, but then the user would see 0 when they viewed the configuration form.
Explicitly converting '' to 0 as needed seems fine. Open to better ideas.
I quickly checked the code for other instances of this problem with expiration warnings, but didn't see any.
Comment #6
aohrvetpv commentedDoes the module error prevent login? Would like to know how serious the issue is for the sake of deciding when to make a next release. I don't currently have a PHP 7 environment to test in. Thank you.
Comment #7
aohrvetpv commented