Commit graph

20 commits

Author SHA1 Message Date
Petr Pchelko
48402ba83a Remove User from password policy check interfaces
This doesn't yet completely eliminate the dependency
on user, because the individual password policy check
functions are still documented to receive User.
Password policy check functions can be defined by
extensions, and configured via $wgPasswordPolicy,
so we still need to unwrap user identity to a User
before passing into the actual check. But, this removes
User from the PassworkPolicyCheck interface.

Change-Id: If813b9b0ebbeb89bc61331c9da8efb86e591bfb9
2021-06-11 10:21:14 -07:00
DannyS712
9fd36dffee Clean up PasswordPolicyChecksTest
Remove ::testPasswordPolicyDescriptionsExist(), should
be redundant to PasswordPolicyStructureTest::testCheckMessage

Use mock User objects instead of real ones, only
->getName() is needed

Change-Id: I362cfcfdbbc53cef54e72bce9bab0d24829472d7
2021-03-14 18:59:52 +00:00
DannyS712
9b43828440 Split PasswordPolicyChecksTest into separate unit tests
Change-Id: I1cec645a6a3c2b2e2dfb2edaf9d60ae5d67b6d17
2021-02-27 22:33:54 +00:00
addshore
959bc315f2 MediaWikiTestCase to MediaWikiIntegrationTestCase
The name change happened some time ago, and I think its
about time to start using the name name!
(Done with a find and replace)

My personal motivation for doing this is that I have started
trying out vscode as an IDE for mediawiki development, and
right now it doesn't appear to handle php aliases very well
or at all.

Change-Id: I412235d91ae26e4c1c6a62e0dbb7e7cf3c5ed4a6
2020-06-30 17:02:22 +01:00
Reedy
ece3f3306d Deprecate PasswordCannotMatchBlacklist
Bug: T254646
Change-Id: I0946d078cba5b60567ac4c804d023945bae61313
2020-06-25 14:45:34 +00:00
Reedy
a26c1c8e59 Remove deprecated PasswordCannotBePopular
Change-Id: I77432ef0257c0dc8aa7c26e075616592e639bfec
2020-06-15 21:57:25 +00:00
Reedy
a67a1bc923 Deprecate PasswordNotInLargeBlacklist
Bug: T254799
Change-Id: If5a23dc2cbe675bac8cc4979bba8c3d4527997a0
2020-06-15 19:54:40 +01:00
sbassett
b86c6751d0 Password policy to check if a password is a substring of a username
Similar to checkPasswordCannotMatchUsername, MediaWiki should ensure
that users are unable to accidentally create or edit their username
to include their password as a substring of said username.

Bug: T241845
Change-Id: I437e91a5b83a792c5ad31e291915491bbb382dfa
2020-01-13 23:09:13 +00:00
Max Semenik
68b763d6ed Improve password test coverage
Change-Id: I7edb8b5fa8dd92acdbead7f6378329bfc74e4a49
2019-11-19 15:00:59 +00:00
Aryeh Gregor
0de9c47b50 Remove Language::factory and getParentLanguage use
Change-Id: I11f8801ef47ec1a1f63d840116e69667e6f3ae3c
2019-10-27 12:34:28 +02:00
Reedy
4260b0f8a9 Remove hard deprecation of PasswordPolicyChecks::checkPopularPasswordBlacklist
It's causing quite a bit of WMF log spam because it's still used in wmf-config

Partial revert of I4c90e361b7538efeb0c5efa7ca61aed2e468591c

Change-Id: I7d1282e4260e7a42bee35b81d77470eb40dea818
2019-08-27 17:53:27 +01:00
Kunal Mehta
643225cbc7 Add some missing @covers tags
Change-Id: Idb9af9515702ee9748755d7799663713b2283647
2019-02-02 21:53:40 -08:00
Reedy
0d3807c510 Deprecate PasswordPolicyChecks::checkPopularPasswordBlacklist
Change-Id: I4c90e361b7538efeb0c5efa7ca61aed2e468591c
2018-12-27 20:45:49 +00:00
Reedy
519ff1a402 Add PasswordPolicy to check the password isn't in the large blacklist
Add wikimedia/password-blacklist 0.1.3, which contains 100,000 common passwords

Bug: T151425
Change-Id: I80572fcee6d23ea04ad9ee683157bab9378b660e
Depends-On: I8aea5a44248da9bb9ff7b328679bff6fcf41750d
2018-11-24 15:46:14 -08:00
Timo Tijhof
553b4b0cd4 password: Move commonpasswords.cdb to includes/password/
Similar to other non-php files used by various classes/libs.

This leaves the serialized/ empty (apart from dotfiles), and as
such the directory was removed.

Change-Id: I538ffe0828843220ac4e161cf2e119deb9bd7ac0
2018-08-01 22:40:30 +00:00
Reedy
18d21c9ba0 Add Special:PasswordPolicies
Bug: T174812
Change-Id: Ifb4876f7309a667154c7469c29e703b6c33d54af
2018-05-19 08:55:39 +00:00
Tim Starling
a9911b2582 Improve test coverage in includes/password
From 21% to 82%.

* Added missing @covers, broadened @covers where appropriate.
* Added tests for some code that lacked them.
* Added a parameter to control the use of hash_pbkdf2() so that the pure
  PHP fallback could be tested. In the non-fallback test, force the use
  of the extension, and mark it skipped if it is not installed.

Bug: T167003
Change-Id: I987e1a89ec343907f4ead7f6192b2d4deb58ac16
2017-06-07 14:28:11 +10:00
Reedy
b5656b6953 Many more function case mismatches
Change-Id: I5d3a5eb8adea1ecbf136415bb9fd7a162633ccca
2016-03-19 00:20:58 +00:00
Reedy
1834ee3d8e Fix numerous class/function casing
Change-Id: I23982bfa0548c9ea3bdb432be7982f1563930715
2016-03-18 23:14:49 +00:00
csteipp
1a20dc9362 Password validity by policy per group
Make password policies defined in a configurable policy, which is
defined by group. A user's password policy will be the maximum of
each group policy that the user belongs to.

Bug: T94774
Change-Id: Iad8e49ffcffed38df6293db0ef31a227d3962003
2015-06-10 10:34:17 -07:00