Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-18002

civicrm accept password with lenght 1 character for useraccount

    Details

    • Versioning Impact:
      Patch (backwards-compatible bug fixes)
    • Documentation Required?:
      None
    • Funding Source:
      Needs Funding

      Description

      Witch Civicrm 4.6.12 in combination with Joomla 3.4.8, a profile was made for registration. In the Advance settings in this profile the Joomla user account registration option is set to Account registration required.
      The profile is published and visitors can successfully register their contact data and create a joomla user account.
      In the profiel a text appears beneath the password field that says: "Provide a password for the new account in both fields."
      Problem: the password is NOT checked as to length (or any other of the parameters set inside Joomla).
      This means that a password with character length 1 is accepted, any length is accepted greater than 0.

      In Joomla the minimum password length available now is 4, most joomla sites use the intern joomla settings to set a larger minimum length. Any change in these settings is not communicated to the civicrm profile i.e the form and the checks of input into the form fields for password.

      A way to small password is obviously not safe for use. And the current situation seems to me to be an error and a serious security issue.

      On the technical reason for this or ways to solve this issue I have nothing useful to offer.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              onderzoekspraktijk Paul Kleingeld
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated: