-
Notifications
You must be signed in to change notification settings - Fork 116
Description
I don't know if this is a bug or my misunderstanding of the comment in the example, 'echo $weak['feedback']['warning']; // will print user-facing feedback on the password, set only when score <= 2', but I tested with a dictionary word and got back a score of 0 with no warning set:
'''
Feb 18 11:43:13 admin php: [password] => everything
...
Feb 18 11:43:13 admin php: [sequence] => Array
Feb 18 11:43:13 admin php: (
Feb 18 11:43:13 admin php: [0] => ZxcvbnPhp\Matchers\DictionaryMatch Object
Feb 18 11:43:13 admin php: (
Feb 18 11:43:13 admin php: [pattern] => dictionary
Feb 18 11:43:13 admin php: [dictionaryName] => us_tv_and_film
Feb 18 11:43:13 admin php: [rank] => 123
Feb 18 11:43:13 admin php: [matchedWord] => everything
Feb 18 11:43:13 admin php: [reversed] =>
Feb 18 11:43:13 admin php: [l33t] =>
Feb 18 11:43:13 admin php: [password] => everything
Feb 18 11:43:13 admin php: [begin] => 0
Feb 18 11:43:13 admin php: [end] => 9
Feb 18 11:43:13 admin php: [token] => everything
Feb 18 11:43:13 admin php: )
Feb 18 11:43:13 admin php:
Feb 18 11:43:13 admin php: )
...
Feb 18 11:43:13 admin php: [score] => 0
Feb 18 11:43:13 admin php: [feedback] => Array
Feb 18 11:43:13 admin php: (
Feb 18 11:43:13 admin php: [warning] =>
Feb 18 11:43:13 admin php: [suggestions] => Array
Feb 18 11:43:13 admin php: (
Feb 18 11:43:13 admin php: [0] => Add another word or two. Uncommon words are better.
Feb 18 11:43:13 admin php: )
Feb 18 11:43:13 admin php:
Feb 18 11:43:13 admin php: )
'''
In our project I made the error to check if feedback warning was set as an indication of a score <= 2, so this allowed bypassing the dictionary check - clearly my error, but maybe is a condition that wasn't supposed to happen?