Skip to content

Commit

Permalink
Fix password check regexp (#879)
Browse files Browse the repository at this point in the history
  • Loading branch information
xoseperez committed May 28, 2018
1 parent f0fffcb commit ad62352
Show file tree
Hide file tree
Showing 4 changed files with 712 additions and 712 deletions.
2 changes: 1 addition & 1 deletion code/espurna/config/general.h
Original file line number Diff line number Diff line change
Expand Up @@ -562,9 +562,9 @@

#ifndef MQTT_AUTOCONNECT
#define MQTT_AUTOCONNECT 1 // If enabled and MDNS_SERVER_SUPPORT=1 will perform an autodiscover and
// autoconnect to the first MQTT broker found if none defined
#endif

// autoconnect to the first MQTT broker found if none defined
#ifndef MQTT_SERVER
#define MQTT_SERVER "" // Default MQTT broker address
#endif
Expand Down
Binary file modified code/espurna/data/index.html.gz
Binary file not shown.
Loading

3 comments on commit ad62352

@matphillips
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It may not be too important, but it's worth mentioning that neither the old or the new regex actually works as described.

With these, this is a valid password: 123Ab
but this is not valid: 123=Ab

Because it is checking for specific instances of characters. A UUID (by definition) is pretty unique and a reasonable password, but is denied by this check, so this password isn't valid: 3BA00E8E-3840-4AE4-A46A-6F30215D5092

I'd suggest just checking for a minimum length and warning the user to pick something good.

@mcspr
Copy link
Collaborator

@mcspr mcspr commented on ad62352 May 30, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@matphillips I just does not check for either - or = and really wants lower-case in UUID. What about dropping regexp completely and just present user with generated password? Via something like this

@matphillips
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Providing a good password automatically is a good solution, many people will just use the "save password" feature of the browser anyway.
I'm just being a bit picky because I ran against a similar problem with a commercial software recently :)

Please sign in to comment.