Users are confused about failing policies on their user edit page, although the new password fields are empty. They don't understand the relationship to these fields.
The easiest way to avoid this confusion would be to hide the whole table until they start typing a new password.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

d4t3r created an issue. See original summary.

tvalimaa’s picture

Hi, I did custom code which hide password policy status thing on user edit and user register form.

hide_pwpolicy.module

<?php

/**
 * @file
 * Custom hide password policy on user edit form.
 */

use Drupal\Core\Form\FormStateInterface;

/**
 * Implements hook_form_alter().
 */
function hide_pwpolicy_form_alter(&$form, FormStateInterface $form_state, $form_id) {
  $whitelist = ['user_form', 'user_register_form'];

  if (in_array($form_id, $whitelist)) {
    $form['#after_build'][] = 'hide_pwpolicy_custom_after_build';

  }
}

function hide_pwpolicy_custom_after_build($form, &$form_state) {
  $form['account']['password_policy_status']['#access'] = FALSE;

  return $form;
}
paulocs’s picture

Status: Active » Postponed

Postponed this issue while #2849271: Decouple display of policy table and policy validation is not committed.

paulocs’s picture

Status: Postponed » Active
sophiavs’s picture

Assigned: Unassigned » sophiavs

I'll work on this

sophiavs’s picture

Assigned: sophiavs » Unassigned
Status: Active » Needs review
sophiavs’s picture

StatusFileSize
new35.22 KB
new102.55 KB

I put a states option on the password policy to show only when the password field is not empty as you can see in the images

gquisini’s picture

Assigned: Unassigned » gquisini

I'll be reviewing

gquisini’s picture

Assigned: gquisini » Unassigned
Status: Needs review » Reviewed & tested by the community
StatusFileSize
new88.12 KB
new99.17 KB
new67.77 KB

Before I switched to MR, which I did:
- Installed password policy and password character length policy.
- I went to /admin/config/security/password-policy/add and created a new policy with the password character length restriction and applied it to Authenticated user
- I went to /user/[user:id]/edit and there are just the recommendations to make the password stronger
- After switching to MR, I went again to edit the user profile and it now shows the recommendations and the password policy restrictions.

I'll attach before/after screenshots to comparison.

Rajeshreeputra made their first commit to this issue’s fork.

rajeshreeputra’s picture

+1 RTBC, rebased.

kristen pol’s picture

Assigned: Unassigned » kristen pol

Assigning to myself as I'm reviewing/merging ready RTBC fixes/updates over the next few days.

kristen pol’s picture

I tested and this seems like a simple UX improvement so I think it's okay to add. Note that it doesn't hide it after the password is deleted but that's probably okay as well.

Related, but not part of this issue is that, when editing a user as an admin (or with certain permissions), the status and roles show up between the password fields and the table which pushes the info far below and the user might not see it. A separate issue could be opened for that.

  • Kristen Pol committed c6be1c5d on 4.0.x
    Issue #3274571 by sophiavs, gquisini, Kristen Pol, paulocs, DrupalBubb,...
kristen pol’s picture

Assigned: kristen pol » Unassigned
Status: Reviewed & tested by the community » Fixed

Thanks everyone for their work on this issue.

The fix has been merged and will be part of the next release.

kristen pol’s picture

Version: 8.x-3.1 » 4.0.0

This was against 4.0.x as 8.x branches are no longer supported, so changing version.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

kristen pol’s picture

Version: 4.0.0 » 4.0.x-dev

This is part of the new 4.0.1 release.