Value 0 as password passed the validation

+1 RTBC

Merge request #10 works well for me. Thanks!

Assigning to myself as I'm reviewing/merging ready RTBC fixes/updates over the next few days.

Thanks to everyone for working on this issue.

1. The MR doesn't have the same code that the patch has. Unclear why the patch has more.

2. We need tests (see the tag) so this is not ready.

Assigning this to myself to work on the issue.

I'm changing the version for this issue from 8.x-3.x-dev to 4.0.0 because 3.x is not compatible with Drupal 10 and 4.0.0 is the recommended release.

I altered the approach to solving this problem from adding a conditional in PasswordPolicyValidator to enabling PasswordPolicyValidator to use constraints that are independent of password_policy submodules, making it easier to maintain and test against those constraints.

MR #70 contains:

1. An update to PasswordPolicyValidator to enable the use of constraints
2. PasswordNotZeroConstraint
3. PasswordNotZeroConstraintTest
4. An update to _password_policy_user_profile_form_validate() that enables password validation when the password is the character zero

@Kristen-Pol, to answer your question about why patch #7 has more logic than MR #10, the update to _password_policy_user_profile_form_validate() -- which originally was in MR10 and was subsequently removed -- is necessary in order for the module to perform password validation when the password has been set as "0".

Assigning to myself to review.

COBadger → closed merge request !71

Please ignore MR 72. That MR is intended to go against https://www.drupal.org/project/password_policy/issues/3236423 ✨ Do not require unique characters in "Password character type" constraint Needs review .

Thanks for the updates. I looked at MR 70 and noted a couple formatting fixes and had a question.

This still needs work per feedback above and needs tests.

empty() considers "0" as false $str === "" would work instead

vishalkhode → closed merge request !10

vishalkhode → made their first commit to this issue’s fork.

Update MR !70 and reverted changes from @COBadger. I think we shouldn't create a new password policy constraint for zero password validation as this should be treated normally because user can enter other single digit numeric / string values like 1 or 2 or 3 or a or b etc. The policy validator should be more of generic validations. I've added strlen condition to fix this issue and added PHPUnit tests as well.

vishalkhode → changed the visibility of the branch 3236423-4.0.x-do-not-require-unique-characters to hidden.

Have updated summary. A password of '0' does not pass the validation, rather the validation is skipped entirely as PHP considers the string 0 as empty, but the password is not saved due to the same logic error existing in Core.

I agree with vishalkhode that there is no need for a new constraint, just explicitly check for empty string instead of using the empty function.