Skip to content

Commit df3715d

Browse files
ryanhellyerryanhellyer
committed
Simplification to use only the new'ish built in WordPress password strength meter system.
1 parent e6f7ee7 commit df3715d

File tree

4 files changed

+86
-208
lines changed

4 files changed

+86
-208
lines changed

‎minimum-password-strength.php

+19-121
Original file line numberDiff line numberDiff line change
@@ -1,121 +1,19 @@
1-
<?php
2-
3-
/*
4-
* Plugin Name: Minimum Password Strength
5-
* Description: Enforce a specific password strength. Uses the same strength calculations as the WordPress password strength meter
6-
* Version: 1.2.0
7-
* Plugin URI: http://wordpress.org/extend/plugins/minimum-password-strength/
8-
* Author: Will Anderson and Tony Ferrell
9-
* Author URI: http://codeawhile.com/
10-
*/
11-
12-
class Minimum_Password_Strength {
13-
14-
const STRENGTH_KEY = 'minimum_password_strength';
15-
const PASS_LENGTH = 4;
16-
const SHORT_PASS = 1;
17-
const BAD_PASS = 2;
18-
const GOOD_PASS = 3;
19-
const STRONG_PASS = 4;
20-
const MISMATCH = 5;
21-
const DEFAULT_REQUIRED_STRENGTH = self::GOOD_PASS;
22-
23-
public static $strengths = array(
24-
2 => 'Weak',
25-
3 => 'Medium',
26-
4 => 'Strong',
27-
);
28-
29-
public static function start() {
30-
add_action( 'user_profile_update_errors', array( __CLASS__, 'check_password_strength' ) );
31-
add_action( 'admin_menu', array( __CLASS__, 'add_menu' ) );
32-
add_action( 'validate_password_reset', array( __CLASS__, 'check_password_strength' ) );
33-
}
34-
35-
public static function check_password_strength( $errors ) {
36-
$password1 = isset( $_POST['pass1'] ) ? $_POST['pass1'] : '';
37-
$password2 = isset( $_POST['pass2'] ) ? $_POST['pass2'] : '';
38-
if ( isset( $_POST['user_id'] ) ) {
39-
// Editing user profile page
40-
$user_id = intval( $_POST['user_id'] );
41-
$user = get_userdata( $user_id );
42-
$username = $user->user_login;
43-
} else {
44-
// Creating a new user
45-
$username = $_POST['user_login'];
46-
}
47-
48-
if ( empty( $password1 ) && empty( $password2 ) ) {
49-
return;
50-
}
51-
52-
$strength = self::get_password_strength( $username, $password1, $password2 );
53-
54-
$required_strength = get_option( self::STRENGTH_KEY, 3 );
55-
56-
if ( self::MISMATCH == $strength ) {
57-
$errors->add( 'mismatched-password', 'The passwords you entered do not match', array( 'form-field' => 'pass1' ) );
58-
} elseif ( $strength < $required_strength ) {
59-
$errors->add( 'weak-password', sprintf( __( 'You must choose a "%s" password', 'minimum-password-strength' ), self::$strengths[$required_strength] ), array( 'form-field' => 'pass1' ) );
60-
}
61-
}
62-
63-
public static function add_menu() {
64-
add_options_page( __( 'Minimum Password Strength', 'minimum-password-strength' ), __( 'Password Strength', 'minimum-password-strength' ), 'manage_options', __FILE__, array( __CLASS__, 'show_settings_page' ) );
65-
}
66-
67-
public static function show_settings_page() {
68-
if ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) &&
69-
wp_verify_nonce( $_POST['_wpnonce'], 'update_minimum_password_strength' ) ) {
70-
$strength = intval( $_POST['strength'] );
71-
update_option( self::STRENGTH_KEY, $strength );
72-
}
73-
74-
$required_strength = self::get_required_strength();
75-
$options = self::$strengths;
76-
77-
include plugin_dir_path( __FILE__ ) . 'views/settings.php';
78-
}
79-
80-
public static function get_required_strength() {
81-
return get_option( self::STRENGTH_KEY, self::DEFAULT_REQUIRED_STRENGTH );
82-
}
83-
84-
public static function get_password_strength( $username, $password1, $password2 ) {
85-
$symbolSize = 0;
86-
87-
// password 1 != password 2
88-
if ( $password1 != $password2 )
89-
return self::MISMATCH;
90-
91-
//password < self::PASS_LENGTH
92-
if ( strlen( $password1 ) < self::PASS_LENGTH )
93-
return self::SHORT_PASS;
94-
95-
//password1 == username
96-
if ( strtolower( $password1 ) == strtolower( $username ) )
97-
return self::BAD_PASS;
98-
99-
if ( preg_match( '/[0-9]/', $password1 ) )
100-
$symbolSize += 10;
101-
if ( preg_match( '/[a-z]/', $password1 ) )
102-
$symbolSize += 26;
103-
if ( preg_match( '/[A-Z]/', $password1 ) )
104-
$symbolSize += 26;
105-
if ( preg_match( '/[^a-zA-Z0-9]/', $password1 ) )
106-
$symbolSize += 31;
107-
108-
$natLog = log( pow( $symbolSize, strlen( $password1 ) ) );
109-
$score = $natLog / log( 2 );
110-
111-
if ( $score < 40 )
112-
return self::BAD_PASS;
113-
114-
if ( $score < 56 )
115-
return self::GOOD_PASS;
116-
117-
return self::STRONG_PASS;
118-
}
119-
}
120-
121-
Minimum_Password_Strength::start();
1+
<?php
2+
3+
/*
4+
* Plugin Name: Minimum Password Strength
5+
* Description: Enforce a specific password strength. Hides the option to ignore weak passwords.
6+
* Version: 2.0.0
7+
* Plugin URI: http://wordpress.org/extend/plugins/minimum-password-strength/
8+
* Author: Will Anderson, Tony Ferrell and Ryan Hellyer
9+
* Author URI: http://codeawhile.com/
10+
*/
11+
12+
13+
add_action( 'admin_enqueue_scripts', 'minimum_password_strength' );
14+
/**
15+
* Hiding the "Confirm use of weak password" checkbox from view.
16+
*/
17+
function minimum_password_strength() {
18+
wp_add_inline_style( 'admin-menu', '.pw-weak {display: none !important;}' );
19+
}

‎readme.md

+54-53
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,55 @@
1-
Minimum Password Strength
2-
=========================
3-
* Contributors: [itsananderson](http://profiles.wordpress.org/itsananderson),
4-
[Zer0Divisor](http://profiles.wordpress.org/Zer0Divisor)
5-
* Donate link:
6-
* Tags: [security](http://wordpress.org/extend/plugins/tags/security),
7-
[password](http://wordpress.org/extend/plugins/tags/password),
8-
[administration](http://wordpress.org/extend/plugins/tags/administration)
9-
* Requires at least: 3.0
10-
* Tested up to: 4.4.2
11-
* Stable tag: 1.2.0
12-
* License: GPLv2 or later
13-
* License URI: http://www.gnu.org/licenses/gpl-2.0.html
14-
15-
Enforce a specific password strength. Uses the same strength calculations as the WordPress password strength meter
16-
17-
Description
18-
-----------
19-
20-
WordPress profile pages contain a visual indicator which shows the strength of a user's chosen password. This is nice, but WordPress doesn't actually enforce this in any way, so users are free to select weak passwords.
21-
22-
Minimum Password Strength uses the same method to calculate a password's strength, but forces users to meet a minimum strength requirement before they can change their password.
23-
24-
By default, passwords must have "Medium" strength, but administrators can change this to force passwords to be at least "Weak", "Medium", or "Strong". To change the minimum strength, go to Settings -> Password Strength after installing Minimum Password Strength.
25-
26-
For now, all users have the same password strength requirements, but a later release will allow administrators to select different strength requirements for different roles.
27-
28-
Installation
29-
------------
30-
31-
1. Upload the 'minimum-password-strength' to the '/wp-content/plugins/' directory
32-
1. Activate the plugin through the 'Plugins' menu in WordPress
33-
1. Configure your required password strength in Settings -> Password Strength
34-
35-
Changelog
36-
---------
37-
38-
#### 1.2.0 ####
39-
* Enforce password strength during password reset
40-
* Update "Tested up to" tag
41-
42-
#### 1.1.2 ####
43-
* Fixing the installation instructions
44-
* Updating the short and long descriptions
45-
* Updating the "Tested up to" tag
46-
47-
#### 1.1.1 ####
48-
* Fixing a broken author name
49-
50-
#### 1.1 ####
51-
* Adding a readme.txt file
52-
53-
#### 1.0 ####
1+
Minimum Password Strength
2+
=========================
3+
* Contributors: [itsananderson](http://profiles.wordpress.org/itsananderson),
4+
[Zer0Divisor](http://profiles.wordpress.org/Zer0Divisor),
5+
[ryanhellyer](http://profiles.wordpress.org/ryanhellyer)
6+
* Donate link:
7+
* Tags: [security](http://wordpress.org/extend/plugins/tags/security),
8+
[password](http://wordpress.org/extend/plugins/tags/password),
9+
[administration](http://wordpress.org/extend/plugins/tags/administration)
10+
* Requires at least: 4.6
11+
* Tested up to: 4.7
12+
* Stable tag: 2.0.0
13+
* License: GPLv2 or later
14+
* License URI: http://www.gnu.org/licenses/gpl-2.0.html
15+
16+
Enforce a specific password strength. Hides the option to ignore weak passwords.
17+
18+
Description
19+
-----------
20+
21+
WordPress profile pages contain a visual indicator which shows the strength of a user's chosen password. This is nice, but WordPress doesn't actually enforce this in any way, so users are free to select weak passwords.
22+
23+
Minimum Password Strength removes the option to bypass the strength suggestion.
24+
25+
Installation
26+
------------
27+
28+
1. Upload the 'minimum-password-strength' to the '/wp-content/plugins/' directory or install via the WordPress plugin installer.
29+
2. Activate the plugin through the 'Plugins' menu in WordPress
30+
31+
Changelog
32+
---------
33+
34+
### 2.0.0 ###
35+
* Change to simply removing the option to bypass the password strength check
36+
* Documentation update
37+
* Update "Tested up to" tag
38+
39+
#### 1.2.0 ####
40+
* Enforce password strength during password reset
41+
* Update "Tested up to" tag
42+
43+
#### 1.1.2 ####
44+
* Fixing the installation instructions
45+
* Updating the short and long descriptions
46+
* Updating the "Tested up to" tag
47+
48+
#### 1.1.1 ####
49+
* Fixing a broken author name
50+
51+
#### 1.1 ####
52+
* Adding a readme.txt file
53+
54+
#### 1.0 ####
5455
* Initial release

‎readme.txt

+13-13
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,33 @@
11
=== Minimum Password Strength ===
2-
Contributors: itsananderson, Zer0Divisor
2+
Contributors: itsananderson, Zer0Divisor, ryanhellyer
33
Donate link:
44
Tags: security, password, administration
5-
Requires at least: 3.0
6-
Tested up to: 4.4.2
7-
Stable tag: 1.2.0
5+
Requires at least: 4.6
6+
Tested up to: 4.7
7+
Stable tag: 2.0.0
88
License: GPLv2 or later
99
License URI: http://www.gnu.org/licenses/gpl-2.0.html
1010

11-
Enforce a specific password strength. Uses the same strength calculations as the WordPress password strength meter
11+
Enforce a specific password strength. Hides the option to ignore weak passwords.
1212

1313
== Description ==
1414

1515
WordPress profile pages contain a visual indicator which shows the strength of a user's chosen password. This is nice, but WordPress doesn't actually enforce this in any way, so users are free to select weak passwords.
1616

17-
Minimum Password Strength uses the same method to calculate a password's strength, but forces users to meet a minimum strength requirement before they can change their password.
18-
19-
By default, passwords must have "Medium" strength, but administrators can change this to force passwords to be at least "Weak", "Medium", or "Strong". To change the minimum strength, go to Settings -> Password Strength after installing Minimum Password Strength.
20-
21-
For now, all users have the same password strength requirements, but a later release will allow administrators to select different strength requirements for different roles.
17+
Minimum Password Strength removes the option to bypass the strength suggestion.
2218

2319
== Installation ==
2420

25-
1. Upload the 'minimum-password-strength' to the '/wp-content/plugins/' directory
26-
1. Activate the plugin through the 'Plugins' menu in WordPress
27-
1. Configure your required password strength in Settings -> Password Strength
21+
1. Upload the 'minimum-password-strength' to the '/wp-content/plugins/' directory or install via the WordPress plugin installer.
22+
2. Activate the plugin through the 'Plugins' menu in WordPress
2823

2924
== Changelog ==
3025

26+
= 2.0.0 =
27+
* Change to simply removing the option to bypass the password strength check
28+
* Documentation update
29+
* Update "Tested up to" tag
30+
3131
= 1.2.0 =
3232
* Enforce password strength during password reset
3333
* Update "Tested up to" tag

‎views/settings.php

-21
This file was deleted.

0 commit comments

Comments
 (0)