- Issue created by @kriboogh
- First commit to issue fork.
- @ankitdebnath opened merge request.
- Status changed to Needs review
over 1 year ago 5:08am 14 September 2023 - Status changed to Needs work
over 1 year ago 10:55am 14 September 2023 - 🇧🇪Belgium kriboogh
Thanks for the proposed solution. I would have like to see it a bit differently:
core.service.yml defines this generator: password_generator: class: Drupal\Core\Password\DefaultPasswordGenerator
In our module we can just decorate and extend that service so you don't need the ServiceProviderBase.
simple_password_policy.services.yml:
simple_password_policy.password_generator: decorates: password_generator class: Drupal\simple_password_policy\SimplePasswordPolicyPasswordGenerator arguments: [ '@simple_password_policy.password_generator.inner', '@config.factory']
and
class SimplePasswordPolicyPasswordGenerator extends DefaultPasswordGenerator { public function __construct(\Drupal\Core\Password\PasswordGeneratorInterface $original_service, ConfigFactoryInterface $configFactory) { $this->originalService = $original_service; $this->configFactory = $configFactory; } .... }
- 🇧🇪Belgium kriboogh
Also using Drupal::random->string is not secure since it is using mt_rand (see php info https://www.php.net/manual/en/function.mt-rand.php).
So we need another solution preferably using random_int which is considered secure. - Assigned to ankitdebnath
- Issue was unassigned.
- Status changed to Needs review
over 1 year ago 5:57pm 14 September 2023 - 🇮🇳India ankitdebnath
Hello @kriboogh, thanks for the review. I have changed the code according to the requirements. Please check it out.
-
ankitdebnath →
committed b96699fb on 1.0.x
Issue #3386961 by ankitdebnath: Alter the password_generator service...
-
ankitdebnath →
committed b96699fb on 1.0.x
-
ankitdebnath →
committed 71037768 on 1.0.x
Issue #3386961 by ankitdebnath: Alter password_generator service to...
-
ankitdebnath →
committed 71037768 on 1.0.x
-
kriboogh →
committed 42d3546c on 1.0.x
Issue #3386961: Use the actual policy to validate the generated password
-
kriboogh →
committed 42d3546c on 1.0.x
- 🇧🇪Belgium kriboogh
Merged in dev, I rewrote the generate so it validates the generated password using the actual policy against the current user.
- Status changed to Fixed
over 1 year ago 8:11am 15 September 2023 - Status changed to Fixed
over 1 year ago 10:58am 15 September 2023