Author |
Topic |
StephenD
Senior Member
Australia
1044 Posts |
Posted - 12 July 2004 : 19:14:28
|
Is there a way to force the password characteristics on registration and whenever a member chooses to change their password? Something like NT security. Password length must be minimum of say 8 characters and contain a combination of characters and numerals?
Has anyone done this before with Snitz? |
|
StephenD
Senior Member
Australia
1044 Posts |
Posted - 22 July 2004 : 03:27:26
|
Just moving up to top...
Would be something like : if len(password)<8 then redirect back to register.asp? |
|
|
Shaggy
Support Moderator
Ireland
6780 Posts |
Posted - 22 July 2004 : 07:25:40
|
For the length issue, all you'd need to do is add a check to one of the existing if statements in register.asp that checks password validity. Don't have exact line references but somewhere in or around line 256 look for the following code block and add the lines in green.'## NT authentication no additional password needed
if strAuthType = "db" then
if not IsValidString(trim(Request.Form("Password"))) then
Err_Msg = Err_Msg & "<li>You may not use any of these chars in your password !#$%^&*()=+{}[]|\;:/?>,<' </li>"
end if
if trim(Request.Form("Password")) = "" then
Err_Msg = Err_Msg & "<li>You must choose a Password</li>"
end if
if Len(Request.Form("Password")) < 8 or Len(Request.Form("Password")) > 25 then
Err_Msg = Err_Msg & "<li>Your Password can not be less than 8 or greater than 25 characters</li>"
end if
if Request.Form("Password") <> Request.Form("Password2") then
Err_Msg = Err_Msg & "<li>Your Passwords didn't match.</li>"
end if
end if
<edit>Actually, you'd need to do the same in pop_profile.asp; there are a couple of occurrences of code similar to the above that should be easy enough to track down with a search.</edit>
|
Search is your friend “I was having a mildly paranoid day, mostly due to the fact that the mad priest lady from over the river had taken to nailing weasels to my front door again.” |
Edited by - Shaggy on 22 July 2004 07:27:18 |
|
|
StephenD
Senior Member
Australia
1044 Posts |
Posted - 22 July 2004 : 18:36:19
|
Excellent, thankyou. |
|
|
Shaggy
Support Moderator
Ireland
6780 Posts |
Posted - 23 July 2004 : 06:23:24
|
You're welcome, Stephen. Another check you might want to add in there for additional security is if the password is the same as the username. Still trying to think of a viable way to check if the password contains a mix of alpha and numeric characters.
|
Search is your friend “I was having a mildly paranoid day, mostly due to the fact that the mad priest lady from over the river had taken to nailing weasels to my front door again.” |
|
|
pknaz
Junior Member
USA
117 Posts |
Posted - 04 August 2004 : 19:08:37
|
You could use something like this to check for numeric characters, but I haven't done anything for alpha characters:
Dim frmPassword as string, frmPassword2 as string
frmPassword = Request.Form("Password")
frmPassword2 = Request.Form("Password2")
If Len(frmPassword) > 0 then
Dim InstrTemp as int
InstrTemp = 0
for i = 0 to 9
If InStr(frmPassword, CStr(i)) <> 0 then
InstrTemp = InstrTemp + 1
end if
next
If InstrTemp = 0 then
Err_Msg = Err_Msg & "<li>Your Password does not contain any numeric characters.</li>"
end if
end if
|
Edited by - pknaz on 04 August 2004 19:10:09 |
|
|
StephenD
Senior Member
Australia
1044 Posts |
Posted - 05 August 2004 : 01:08:09
|
Thanks pknaz, will it allow alpha characters too? I won't be able to test it till I get home tonight. |
|
|
OneWayMule
Dev. Team Member & Support Moderator
Austria
4969 Posts |
|
Shaggy
Support Moderator
Ireland
6780 Posts |
Posted - 05 August 2004 : 07:41:39
|
I've modified what Pknaz posted above to add a similar for/next loop to check for the presence of letters and clean up a few things. The code below can be added to the code I posted above; I'd suggest before the comaprisn between PAssword and Password2.boolPwnumeric=0
boolPwalpha=0
for i=0 to 9
if instr(trim(Request.Form("Password")),i)<>0 then
boolPwNumeric=1
exit for
end if
next
for i=97 to 122
if instr(trim(Request.Form("Password")),chr(i))<>0 or instr(trim(Request.Form("Password")),ucase(chr(i)))<>0 then
boolPwalpha=1
exit for
end if
next
if boolPwnumeric=0 or boolPwalpha=0 then Err_Msg=Err_Msg&"<li>Your password must combination of alphanumeric characters.</li>" Admittedly, it's not exactly the "prettiest" way of doing this, but it serves it's purpose.
|
Search is your friend “I was having a mildly paranoid day, mostly due to the fact that the mad priest lady from over the river had taken to nailing weasels to my front door again.” |
|
|
Nertz
Junior Member
Canada
341 Posts |
Posted - 05 August 2004 : 10:20:22
|
Shaggy, please excuse my ignorance as I'm new to ASP but always willing to learn. Hope this is not trivial and I didn't miss something somewhere.
In your check for illegal characters in the post above, the password is passed through the trim function which removes all leading and trailing spaces, defeating the check for invalid leading or trailing spaces in the IsValidString function. And even if passed the raw password, IsValidString function appears to check occurence of leading, trailing and double spaces only. Any space anywhere in the password should be illegal.
if instr(Request.Form("Password")," ")<> 0 then Err_Msg = Err_Msg & "<li>Your Password cannot contain spaces.</li>" end if
cheers, Nat
|
Sadly, most Family Court Judges wrongfully reward opportunistic gold diggers that use our children unjustly as "instruments" of power.
www.fathers-4-justice-canada.ca |
|
|
Shaggy
Support Moderator
Ireland
6780 Posts |
Posted - 05 August 2004 : 12:33:54
|
IsValidString() checks for the presence of any special characters in the password field without removing any leading or trailing white space. For each subsequent check of the password field the value as originally entered by the user is retrieved.
And that's not a bad idea, checking for apaces within the password itself. Gimme a minute and I'll put all the code in this topic together in one easy to copy block.
|
Search is your friend “I was having a mildly paranoid day, mostly due to the fact that the mad priest lady from over the river had taken to nailing weasels to my front door again.” |
|
|
Nertz
Junior Member
Canada
341 Posts |
Posted - 05 August 2004 : 14:09:47
|
One final thought Shaggy. I think the first character in the password should be restricted to alpha only.
if instr("ABCDEFGHIJKLMNOPQRSTUVWXYZ", UCase(left(Request.Form("Password"),1))) = 0 then
Err_Msg = Err_Msg & "<li>The Password's first character must be an alpha character.</li>"
end if
cheers, Nat |
Sadly, most Family Court Judges wrongfully reward opportunistic gold diggers that use our children unjustly as "instruments" of power.
www.fathers-4-justice-canada.ca |
Edited by - Nertz on 05 August 2004 14:13:02 |
|
|
daniel123
Starting Member
21 Posts |
Posted - 06 August 2004 : 04:01:34
|
is it possible for admin to view passwords of members? |
|
|
davemaxwell
Access 2000 Support Moderator
USA
3020 Posts |
Posted - 06 August 2004 : 05:44:58
|
quote: Originally posted by daniel123
is it possible for admin to view passwords of members?
NO. They are encrypted for just that reason. The use can use the "forgot password" link or the admin can change the password to something else, but there is no good reason for an admin to be able to see passwords. |
Dave Maxwell Barbershop Harmony Freak |
|
|
Shaggy
Support Moderator
Ireland
6780 Posts |
Posted - 06 August 2004 : 06:59:07
|
Sorry, didn't realise how late it was when i posted yesterday; had to run. Here's all the code and checks that have been mentioned so far in this topic including a checks for: - Spaces - "Special" characters - Password length - A mix of alphanumeric characters - Passwords that don't start with a letter - Passwords that are the same as the username - Password fields that don't match each other.
You'll also need to do something similar in pop_profile.asp; if anyone needs the axact code changes, post back and I'll lash 'em together. Also, please bear in mind that I haven't fully tested this code yet.
The following replaces the entire if statement beginning on line 256 of register.asp.'## NT authentication no additional password needed
'## Modified by Shaggy with assistance from pknaz and Nertz
if strAuthType = "db" then
'## create variable to hold password
dim boolPwalpha,boolPwletter,boolPwnumeric,strTempPass
strTempPass=trim(request.form("password"))
'## check for presence of "special" characters or spaces
if not IsValidString(strTempPass) or instr(strTempPass," ")<>0 then Err_Msg=Err_Msg&"<li>You may not use spaces nor any of these characters in your password !#$%^&*()=+{}[]|\;:/?>,<'""</li>"
'## redundant due to the check below
' if strTempPass="" then Err_Msg=Err_Msg&"<li>You must choose a Password</li>"
'## check password length. change eight for minimum allowed chracters and 25 for maximum allowed
if len(strTempPass)<8 or len(strTempPass)>25 then Err_Msg=Err_Msg&"<li>Your Password can not be less than 8 nor greater than 25 characters.</li>"
'## check password contains both alpha and numeric chracters
boolPwnumeric=0
'## comment/delete 1 line below to remove check for first chracter being alpha
boolPwletter=0
boolPwalpha=0
for i=0 to 9
if instr(strTempPass,i)<>0 then
boolPwNumeric=1
exit for
end if
next
if boolPwNumeric=1 then
for i=97 to 122
'## comment/delete 5 lines below to remove check for first chracter being alpha
if lcase(left(strTempPass,1))=chr(i) then
boolPwletter=1
boolPwalpha=1
exit for
end if
'##
if instr(lcase(strTempPass),chr(i))<>0 then
boolPwalpha=1
exit for
end if
next
end if
'## comment/delete 1 line below to remove check for first chracter being alpha
if boolPwletter=0 then Err_Msg=Err_Msg&"<li>The first chracter of your password must be a letter.</li>"
if boolPwnumeric=0 or boolPwalpha=0 then Err_Msg=Err_Msg&"<li>Your password must contain combination of alphanumeric characters and begin with a letter.</li>"
'##
'## check password is not the same as username
if strTempPass=trim(Request.Form("Name")) then Err_Msg=Err_Msg&"<li>Your password cannot be the same as your username.</li>"
'## chcek both password fields match
if strTempPass<>trim(Request.Form("Password2")) then Err_Msg=Err_Msg&"<li>Your Passwords didn't match.</li>"
end if
'## end Shaggy's modifications <edits> 10-08-04: created a variable to hold password 11-08-04: moved the check for the first character being a letter 11-08-04: declared additional variables 11-08-04: trimmed the passowrd when requesting it 11-08-04: added trim to password 2 24-08-04: updated to include changes detailed here. </edits>
|
Search is your friend “I was having a mildly paranoid day, mostly due to the fact that the mad priest lady from over the river had taken to nailing weasels to my front door again.” |
Edited by - Shaggy on 24 August 2004 06:50:50 |
|
|
daniel123
Starting Member
21 Posts |
Posted - 06 August 2004 : 17:04:54
|
quote: Originally posted by davemaxwell
quote: Originally posted by daniel123
is it possible for admin to view passwords of members?
NO. They are encrypted for just that reason. The use can use the "forgot password" link or the admin can change the password to something else, but there is no good reason for an admin to be able to see passwords.
there is such mod available at shnforum.com |
|
|
Topic |
|