diff --git a/app/Http/Requests/ProfileFormRequest.php b/app/Http/Requests/ProfileFormRequest.php index 72b7b00603..bc0ef0f7dc 100644 --- a/app/Http/Requests/ProfileFormRequest.php +++ b/app/Http/Requests/ProfileFormRequest.php @@ -50,7 +50,7 @@ class ProfileFormRequest extends Request // fixed return [ 'current_password' => 'required', - 'new_password' => 'required|confirmed|secure_password', + 'new_password' => 'required|confirmed|secure_password|min:16', 'new_password_confirmation' => 'required', ]; } diff --git a/app/Providers/FireflyServiceProvider.php b/app/Providers/FireflyServiceProvider.php index 67c82adc29..e489379798 100644 --- a/app/Providers/FireflyServiceProvider.php +++ b/app/Providers/FireflyServiceProvider.php @@ -48,7 +48,7 @@ use FireflyIII\Services\FireflyIIIOrg\Update\UpdateRequest; use FireflyIII\Services\FireflyIIIOrg\Update\UpdateRequestInterface; use FireflyIII\Services\IP\IpifyOrg; use FireflyIII\Services\IP\IPRetrievalInterface; -use FireflyIII\Services\Password\PwndVerifierV3; +use FireflyIII\Services\Password\PwndVerifierV2; use FireflyIII\Services\Password\Verifier; use FireflyIII\Support\Amount; use FireflyIII\Support\ExpandedForm; @@ -189,7 +189,7 @@ class FireflyServiceProvider extends ServiceProvider $this->app->bind(ExchangeRateInterface::class, $class); // password verifier thing - $this->app->bind(Verifier::class, PwndVerifierV3::class); + $this->app->bind(Verifier::class, PwndVerifierV2::class); // IP thing: $this->app->bind(IPRetrievalInterface::class, IpifyOrg::class); diff --git a/app/Services/Password/PwndVerifierV3.php b/app/Services/Password/PwndVerifierV3.php deleted file mode 100644 index 817d9ccf2c..0000000000 --- a/app/Services/Password/PwndVerifierV3.php +++ /dev/null @@ -1,96 +0,0 @@ -. - */ - -declare(strict_types=1); - -namespace FireflyIII\Services\Password; - - -use Exception; -use GuzzleHttp\Client; -use GuzzleHttp\Exception\GuzzleException; -use Log; -use RuntimeException; - -/** - * Class PwndVerifierV3 - * @codeCoverageIgnore - * @codeCoverageIgnore - * @deprecated - */ -class PwndVerifierV3 implements Verifier -{ - - /** - * Verify the given password against (some) service. - * - * @param string $password - * - * @return bool - */ - public function validPassword(string $password): bool - { - Log::debug('Now in API v3.'); - $hash = strtoupper(sha1($password)); - $prefix = substr($hash, 0, 5); - $rest = substr($hash, 5); - $uri = sprintf('https://api.pwnedpasswords.com/%s/%s', 'range', $prefix); - - Log::debug(sprintf('URI is %s', $uri)); - - $headers = [ - 'User-Agent' => sprintf('Firefly III v%s', config('firefly.version')), - ]; - Log::debug('Headers', $headers); - $opts = [ - 'headers' => $headers, - 'timeout' => 5, - ]; - - Log::debug(sprintf('hash prefix is %s', $prefix)); - Log::debug(sprintf('rest is %s', $rest)); - - try { - $client = new Client; - $res = $client->request('GET', $uri, $opts); - } catch (GuzzleException|Exception $e) { - Log::error(sprintf('Could not verify password security: %s', $e->getMessage())); - return true; - } - Log::debug(sprintf('Status code returned is %d', $res->getStatusCode())); - if (404 === $res->getStatusCode()) { - return true; - } - $body = $res->getBody()->getContents(); - try { - $strpos = stripos($body, $rest); - } catch (RuntimeException $e) { - Log::error(sprintf('Could not get body from Pwnd result: %s', $e->getMessage())); - $strpos = false; - } - if (false === $strpos) { - Log::debug(sprintf('%s was not found in result body. Return true.', $rest)); - return true; - } - Log::debug(sprintf('Found %s, so return FALSE.', $rest)); - return false; - } -} diff --git a/app/Support/Http/Controllers/RequestInformation.php b/app/Support/Http/Controllers/RequestInformation.php index a0110bd3b7..425c427f3c 100644 --- a/app/Support/Http/Controllers/RequestInformation.php +++ b/app/Support/Http/Controllers/RequestInformation.php @@ -300,7 +300,7 @@ trait RequestInformation $data, [ 'email' => 'required|string|email|max:255|unique:users', - 'password' => 'required|string|min:6|secure_password|confirmed', + 'password' => 'required|string|min:16|secure_password|confirmed', ] ); } diff --git a/resources/views/v1/profile/change-password.twig b/resources/views/v1/profile/change-password.twig index 2ea8d99b96..01832fc6a5 100644 --- a/resources/views/v1/profile/change-password.twig +++ b/resources/views/v1/profile/change-password.twig @@ -52,7 +52,7 @@ - {{ ExpandedForm.checkbox('verify_password','1', false) }} + {{ ExpandedForm.checkbox('verify_password','1', true) }}

{{ 'what_is_pw_security'|_ }}