fix(auth): treat zxcvbn suggestions as advice, not blocking errors (#1247)

Browse Source

Stable twin of #1050. passwordValidation.js is byte-identical between the
branches, so this is the same change verbatim.

validatePassword() appended zxcvbn's feedback.suggestions to the errors
array unconditionally, and validity is errors.length === 0 — so any
password that merely earned a suggestion was rejected even when it
satisfied every configured rule. The effective policy was stricter than
the configured complexity level and invisible to the admin.

Co-authored-by: Paul Nothaft <[email protected]>
Co-authored-by: Peifu Mo <[email protected]>

...

This commit is contained in:

Paul Nothaft

2026-09-01 08:05:57 +02:00

committed by GitHub

co-authored by Paul Nothaft Peifu Mo

parent c05faa50d9

commit eebca9900b

18 changed files with 64 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

ml/app/__pycache__/__init__.cpython-312.pyc

BIN

Binary file not shown.