Skip to content

Tarea # 3587Añadida la comporbación de nivel de la contraseña #1910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
EstebanSM85 wants to merge 1 commit into
base: master
Choose a base branch
from
+62 −25
Open

Tarea # 3587Añadida la comporbación de nivel de la contraseña #1910

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 40 additions & 3 deletions Core/Model/User.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,9 +327,46 @@ public function removeRole(?string $code): bool

public function setPassword($value): bool
{
// si la contraseña tiene menos de 8 caracteres, o no tiene números o no tiene letras, devolvemos false
if (strlen($value) < 8 || !preg_match('/[0-9]/', $value) || !preg_match('/[a-zA-Z]/', $value)) {
return false;
// Password strength configurable via FS_PASSWORDS_STRENGTH (low|medium|hard)
$strength = defined('FS_PASSWORDS_STRENGTH') ? FS_PASSWORDS_STRENGTH : 'medium';

switch ($strength) {
case 'low':
// mínimo 6 caracteres
if (strlen($value) < 6) {
return false;
}
break;

case 'medium':
// mínimo 10 caracteres, con números, letras y algún signo de puntuación
if (strlen($value) < 10
|| !preg_match('/[0-9]/', $value)
|| !preg_match('/[a-zA-Z]/', $value)
|| !preg_match('/[[:punct:]]/', $value)
) {
return false;
}
break;

case 'hard':
// mínimo 12 caracteres, números, letras, mayúsculas, minúsculas y algún signo de puntuación
if (strlen($value) < 12
|| !preg_match('/[0-9]/', $value)
|| !preg_match('/[A-Z]/', $value)
|| !preg_match('/[a-z]/', $value)
|| !preg_match('/[[:punct:]]/', $value)
) {
return false;
}
break;

default:
// Fallback a la validación histórica: mínimo 8, letras y números
if (strlen($value) < 8 || !preg_match('/[0-9]/', $value) || !preg_match('/[a-zA-Z]/', $value)) {
return false;
}
break;
}

$this->password = password_hash($value, PASSWORD_DEFAULT);
Expand Down
44 changes: 22 additions & 22 deletions Test/Core/Model/UserTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,15 +72,15 @@ public function testCreateUser(): void
{
$user = new User();
$user->nick = 'test1';
$user->setPassword('test9876');
$user->setPassword('testpass1!');
$this->assertTrue($user->save());

// comprobamos que se ha creado el usuario
$this->assertTrue($user->exists());

// comprobamos la contraseña
$this->assertNotEquals('test', $user->password);
$this->assertTrue($user->verifyPassword('test9876'));
$this->assertTrue($user->verifyPassword('testpass1!'));
$this->assertFalse($user->verifyPassword('test6789'));

// eliminamos
Expand All @@ -92,7 +92,7 @@ public function testEscapeHtml(): void
// creamos un usuario con html en lastbrowser y lastip
$user = new User();
$user->nick = 'test1';
$user->setPassword('test1010');
$user->setPassword('testpass1!');
$user->lastbrowser = '<script>alert("test");</script>';
$user->lastip = '<b>123456</b>';
$this->assertTrue($user->save());
Expand All @@ -110,7 +110,7 @@ public function testCantUseBadEmail(): void
// creamos un usuario con un email incorrecto
$user = new User();
$user->nick = 'test2';
$user->setPassword('test2345');
$user->setPassword('testpass2!');
$user->email = 'bademail';
$this->assertFalse($user->save());
}
Expand All @@ -120,7 +120,7 @@ public function testCantUseBadNick(): void
// creamos un usuario con un nick incorrecto
$user = new User();
$user->nick = 'bad nick';
$user->setPassword('password3456');
$user->setPassword('passw0rd1!');
$this->assertFalse($user->save());
}

Expand All @@ -129,7 +129,7 @@ public function testCantUseBadAgent(): void
// creamos un usuario con un agente que no existe
$user = new User();
$user->nick = 'test4';
$user->setPassword('password4567');
$user->setPassword('passw0rd2!');
$user->codagente = 1234;
$this->assertTrue($user->save());

Expand All @@ -145,22 +145,22 @@ public function testPassword(): void
// creamos un usuario
$user = new User();
$user->nick = 'test_password';
$this->assertTrue($user->setPassword('password5678'));
$this->assertTrue($user->setPassword('Password1!'));
$this->assertTrue($user->save());

// comprobamos que se ha encriptado la contraseña
$this->assertNotEquals('password5678', $user->password);

// validamos la contraseña
$this->assertTrue($user->verifyPassword('password5678'));
$this->assertTrue($user->verifyPassword('Password1!'));
$this->assertFalse($user->verifyPassword('password6789'));

// cambiamos la contraseña
$this->assertTrue($user->setPassword('password-789'));
$this->assertTrue($user->setPassword('Password-789!'));
$this->assertTrue($user->save());

// validamos la nueva contraseña
$this->assertTrue($user->verifyPassword('password-789'));
$this->assertTrue($user->verifyPassword('Password-789!'));
$this->assertFalse($user->verifyPassword('password8'));

// intentamos poner una contraseña débil
Expand All @@ -171,7 +171,7 @@ public function testPassword(): void
$this->assertFalse($user->setPassword('12345678'));

// comprobamos que la contraseña no ha cambiado
$this->assertTrue($user->verifyPassword('password-789'));
$this->assertTrue($user->verifyPassword('Password-789!'));

// eliminamos
$this->assertTrue($user->delete());
Expand All @@ -182,7 +182,7 @@ public function testNewPassword(): void
// creamos un usuario
$user = new User();
$user->nick = 'test_new_password';
$user->setPassword('password-012');
$user->setPassword('Password1!');
$this->assertTrue($user->save());

// probamos 2 contraseñas mal
Expand All @@ -191,15 +191,15 @@ public function testNewPassword(): void
$this->assertFalse($user->save());

// probamos 2 contraseñas iguales
$user->newPassword = 'password-8765';
$user->newPassword2 = 'password-8765';
$user->newPassword = 'Password-8765!';
$user->newPassword2 = 'Password-8765!';
$this->assertTrue($user->save());

// comprobamos que se ha encriptado la contraseña
$this->assertNotEquals('password-8765', $user->password);

// validamos la contraseña
$this->assertTrue($user->verifyPassword('password-8765'));
$this->assertTrue($user->verifyPassword('Password-8765!'));
$this->assertFalse($user->verifyPassword('password-9999'));

// eliminamos
Expand All @@ -211,7 +211,7 @@ public function testLogKey(): void
// creamos un usuario
$user = new User();
$user->nick = 'test_log_key';
$user->setPassword('password9876');
$user->setPassword('Password1!');
$this->assertTrue($user->save());

// guardamos la clave
Expand Down Expand Up @@ -251,7 +251,7 @@ public function testDefaultRole(): void
// creamos un usuario
$user = new User();
$user->nick = 'test_role1';
$user->setPassword('password101');
$user->setPassword('Password1!');
$this->assertTrue($user->save());

// comprobamos que se ha asignado el rol
Expand Down Expand Up @@ -316,7 +316,7 @@ public function testPermissions(): void
// creamos un usuario
$user = new User();
$user->nick = 'test6';
$user->setPassword('password678');
$user->setPassword('Password1!');
$this->assertTrue($user->save());

// comprobamos que no tiene roles
Expand Down Expand Up @@ -381,7 +381,7 @@ public function testPermissionOnMultiRole(): void
// creamos un usuario
$user = new User();
$user->nick = 'test7';
$user->setPassword('password789');
$user->setPassword('Password1!');
$this->assertTrue($user->save());

// creamos un rol
Expand Down Expand Up @@ -447,7 +447,7 @@ public function testAddRole(): void
// creamos un usuario
$user = new User();
$user->nick = 'test_add_user';
$user->setPassword('password123');
$user->setPassword('Password1!');
$this->assertTrue($user->save());

// comprobamos que el usuario no tiene roles inicialmente
Expand Down Expand Up @@ -494,7 +494,7 @@ public function testRemoveRole(): void
// creamos un usuario
$user = new User();
$user->nick = 'test_remove_user';
$user->setPassword('password456');
$user->setPassword('Password1!');
$this->assertTrue($user->save());

// añadimos ambos roles al usuario
Expand Down Expand Up @@ -557,7 +557,7 @@ public function testAddRoleUpdatesHomepage(): void
// creamos un usuario sin homepage
$user = new User();
$user->nick = 'test_homepage_user';
$user->setPassword('password789');
$user->setPassword('Password1!');
$user->homepage = null;
$this->assertTrue($user->save());

Expand Down