Add feature to block common (weak) passwords.

This closes the hole of passwords hardcoded in r72475,r74213. Also see r75589.

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 1414d83..fd6bcbb 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -2770,6 +2770,12 @@ $wgMinimalPasswordLength = 1;
  */
 $wgLivePasswordStrengthChecks = false;
 
+/**
+ * List of weak passwords which shouldn't be allowed.
+ * The items should be in lowercase. The check is case insensitive.
+ */
+$wgWeakPasswords = array( 'password', 'passpass', 'passpass1' );
+
 /**
  * Maximum number of Unicode characters in signature
  */

diff --git a/includes/User.php b/includes/User.php
index 7fc0cce..9eec233 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -601,18 +601,22 @@ class User {
         * @return mixed: true on success, string of error message on failure
         */
        function getPasswordValidity( $password ) {
-               global $wgMinimalPasswordLength, $wgContLang;
+               global $wgMinimalPasswordLength, $wgWeakPasswords, $wgContLang;
 
                $result = false; //init $result to false for the internal checks
 
                if( !wfRunHooks( 'isValidPassword', array( $password, &$result, $this ) ) )
                        return $result;
 
+               $lcPassword = $wgContLang->lc( $password );
+
                if ( $result === false ) {
                        if( strlen( $password ) < $wgMinimalPasswordLength ) {
                                return 'passwordtooshort';
-                       } elseif ( $wgContLang->lc( $password ) == $wgContLang->lc( $this->mName ) ) {
+                       } elseif ( $lcPassword == $wgContLang->lc( $this->mName ) ) {
                                return 'password-name-match';
+                       } elseif ( in_array( $lcPassword, $wgWeakPasswords ) ) {                        
+                               return 'password-too-weak';
                        } else {
                                //it seems weird returning true here, but this is because of the
                                //initialization of $result to false above. If the hook is never run or it

diff --git a/languages/messages/MessagesEn.php b/languages/messages/MessagesEn.php
index 9458d61..f9ddda9 100644 (file)
--- a/languages/messages/MessagesEn.php
+++ b/languages/messages/MessagesEn.php
@@ -1085,6 +1085,7 @@ Please try again.',
 Please try again.',
 'passwordtooshort'           => 'Passwords must be at least {{PLURAL:$1|1 character|$1 characters}}.',
 'password-name-match'        => 'Your password must be different from your username.',
+'password-too-weak'          => 'The provided password is too weak and cannot be used.',
 'mailmypassword'             => 'E-mail new password',
 'passwordremindertitle'      => 'New temporary password for {{SITENAME}}',
 'passwordremindertext'       => 'Someone (probably you, from IP address $1) requested a new

diff --git a/maintenance/language/messages.inc b/maintenance/language/messages.inc
index 7abedfc..12dd290 100644 (file)
--- a/maintenance/language/messages.inc
+++ b/maintenance/language/messages.inc
@@ -430,6 +430,7 @@ $wgMessageStructure = array(
                'wrongpasswordempty',
                'passwordtooshort',
                'password-name-match',
+               'password-too-weak',
                'mailmypassword',
                'passwordremindertitle',
                'passwordremindertext',