Change User Password Function

[Former Member]

Hi

I have been testing this functionality and find that:

a) user passwords can be changed in the Admin >Users>Security area but although the new password is tested correctly for minimum length set in config settings it ignores the setting MinRequiredNonAlphanumericCharacters. I currently have this set to 1 ( the default ) but it accepts a password without any non-alphanumeric characters.

How does this config setting work and is it currently active or ignored?

b) I cannot effect a user-driven 'change password' from the link on the MyAccount>Profile page

If I enter correctly the existing password and a new password that meets the configuration conditions, clicking the update button takes me back to the MyAccount page and there is no confirmation message of the new password having been accepted and the password remains unchanged. This situation is unaffected ( as I would expect ) by the synch process.

If I incorrectly enter the existing password and enter a valid new password the incorrect existing password is displayed in red text in place of the standard error message text.

Can anyone offer any suggestions as to what I may have done wrong and how a user may validly change their own password.

Thanks

[Former Member]

This is a bug in pl11.

It's been reported.

[Former Member]

Thanks Bryce,

but what has been reported

the change password issue or the min NonAlphanumeric characters or both?

[Former Member]

Well I was going to add that the admin password reset area probably shouldn't have those limitations, because the idea behind the limitations is so users don't choose easy passwords, but the admin should be able to override this.

What do you think?

[Former Member]

I kind of agree with your logic separating the User reset ( restricted) from the Admin reset ( unrestricted ).

But despite all this we have two situations where the passwords set may escape any such attempts to make them more secure

- the situation whereby passwords can be reset ( apparently - I haven't managed to get it to work ) by the system itself

- and (in certain circumstances) the initial passwords on account creation

There is nothing in the system that forces a user to change a reset password or initial password as is certainly common in these scenarios for lots of systems.

Unless this functionality is added I think the Minimum NonAlphanumeric Characters setting may be of limited value

[Former Member]

Agreed and duly noted