Details
-
Type: Bug
-
Status: Open
-
Priority: Major
-
Resolution: Unresolved
-
Affects Version/s: 4.6.9, 4.6.10, 4.6.12, 4.7.6
-
Fix Version/s: Unscheduled
-
Component/s: CiviCRM Profile, Joomla Integration
-
Labels:
-
Versioning Impact:Patch (backwards-compatible bug fixes)
-
Documentation Required?:None
-
Funding Source:Needs Funding
Description
Witch Civicrm 4.6.12 in combination with Joomla 3.4.8, a profile was made for registration. In the Advance settings in this profile the Joomla user account registration option is set to Account registration required.
The profile is published and visitors can successfully register their contact data and create a joomla user account.
In the profiel a text appears beneath the password field that says: "Provide a password for the new account in both fields."
Problem: the password is NOT checked as to length (or any other of the parameters set inside Joomla).
This means that a password with character length 1 is accepted, any length is accepted greater than 0.
In Joomla the minimum password length available now is 4, most joomla sites use the intern joomla settings to set a larger minimum length. Any change in these settings is not communicated to the civicrm profile i.e the form and the checks of input into the form fields for password.
A way to small password is obviously not safe for use. And the current situation seems to me to be an error and a serious security issue.
On the technical reason for this or ways to solve this issue I have nothing useful to offer.