nextcloud / nextcloud/password_policy
Forbid username, domain, themed name as password
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 39
- Forks
- 27
- Avg merge
- 1h 36m
- Merged PRs (30d)
- 10
Description
Hello everyone,
yesterday I discovered a strange thing: it’s possible to use the Username as password (testet in NC17 and NC18). App "password policy" is active.
If your Username rules the password policy you can set the Username as password
Should that be so ???
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue reports that the password policy accepts a user's username as their password, and its title also mentions domain and themed names. No file or test is named, so start by reproducing the behavior with the password policy enabled and locating the password validation entry point; done means the intended names are rejected with coverage for the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100