From bdf73c1f06c6ea236a47ff900e6b20bf71caa639 Mon Sep 17 00:00:00 2001
From: paul <paul-nothaft@hotmail.de>
Date: Tue, 15 Jul 2025 22:29:19 +0200
Subject: [PATCH] fix: properly allow date-based passwords for galleries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Added skipStrengthCheck option to bypass zxcvbn analysis for gallery passwords
- Added explicit date pattern matching for formats like "04.07.2025"
- Date passwords (DD.MM.YYYY, DD/MM/YYYY, DD-MM-YYYY) are now automatically accepted
- Gallery passwords skip all strength requirements but maintain 6 character minimum
- Fixes production issue where date passwords were rejected by zxcvbn

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 backend/src/utils/passwordValidation.js | 27 +++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/backend/src/utils/passwordValidation.js b/backend/src/utils/passwordValidation.js
index 1941348..4274cfd 100644
--- a/backend/src/utils/passwordValidation.js
+++ b/backend/src/utils/passwordValidation.js
@@ -78,6 +78,16 @@ function validatePassword(password, options = {}) {
     }
   }
   
+  // Skip zxcvbn check if explicitly disabled (for gallery passwords)
+  if (options.skipStrengthCheck) {
+    return {
+      valid: errors.length === 0,
+      errors,
+      score: 2, // Default moderate score for gallery passwords
+      feedback: {}
+    };
+  }
+  
   // Use zxcvbn for strength analysis
   const strength = zxcvbn(password);
   
@@ -121,19 +131,32 @@ function validatePasswordInContext(password, context, userData = {}) {
       requireNumbers: false, // Numbers are optional
       requireSpecialChars: false, // Special chars are optional
       preventCommonPasswords: true, // Still prevent common passwords
-      minStrengthScore: 0 // Accept any score for galleries
+      minStrengthScore: 0, // Accept any score for galleries
+      skipStrengthCheck: true // Skip zxcvbn strength analysis for galleries
     };
     
     // Base validation with gallery-specific options
     const result = validatePassword(password, galleryOptions);
     
+    // Override validation for common date formats
+    // Allow passwords like "04.07.2025", "04/07/2025", "04-07-2025"
+    const datePattern = /^\d{1,2}[.\/-]\d{1,2}[.\/-]\d{4}$/;
+    if (datePattern.test(password)) {
+      // Date format is valid for gallery passwords
+      return {
+        valid: true,
+        errors: [],
+        score: 2,
+        feedback: {}
+      };
+    }
+    
     // Additional gallery-specific checks
     if (password.length < 6) {
       result.valid = false;
       result.errors = ['Password must be at least 6 characters long'];
     }
     
-    // Allow date-based passwords like "04.07.2025"
     // Check if it's too simple (e.g., just "123456")
     if (/^\d{1,6}$/.test(password)) {
       result.valid = false;