Value 0 as password passed the validation

+1 RTBC

Merge request #10 works well for me. Thanks!

Assigning to myself as I'm reviewing/merging ready RTBC fixes/updates over the next few days.

Thanks to everyone for working on this issue.

1. The MR doesn't have the same code that the patch has. Unclear why the patch has more.

2. We need tests (see the tag) so this is not ready.

Assigning this to myself to work on the issue.

I'm changing the version for this issue from 8.x-3.x-dev to 4.0.0 because 3.x is not compatible with Drupal 10 and 4.0.0 is the recommended release.

I altered the approach to solving this problem from adding a conditional in PasswordPolicyValidator to enabling PasswordPolicyValidator to use constraints that are independent of password_policy submodules, making it easier to maintain and test against those constraints.

MR #70 contains:

1. An update to PasswordPolicyValidator to enable the use of constraints
2. PasswordNotZeroConstraint
3. PasswordNotZeroConstraintTest
4. An update to _password_policy_user_profile_form_validate() that enables password validation when the password is the character zero

@Kristen-Pol, to answer your question about why patch #7 has more logic than MR #10, the update to _password_policy_user_profile_form_validate() -- which originally was in MR10 and was subsequently removed -- is necessary in order for the module to perform password validation when the password has been set as "0".

Assigning to myself to review.

COBadger → closed merge request !71

Please ignore MR 72. That MR is intended to go against https://www.drupal.org/project/password_policy/issues/3236423 ✨ Do not require unique characters in "Password character type" constraint Needs review .

Thanks for the updates. I looked at MR 70 and noted a couple formatting fixes and had a question.

This still needs work per feedback above and needs tests.

empty() considers "0" as false $str === "" would work instead