* finish task #6208.

module/sso/model.php

@@ -61,12 +61,6 @@ class ssoModel extends model
             $user = $this->dao->select('*')->from(TABLE_USER)->where('account')->eq($data->account)->fetch();
             if($user) die(js::alert($this->lang->sso->bindHasAccount));
 
-            if(isset($this->config->safe->mode) and $this->user->computePasswordStrength($data->password1) < $this->config->safe->mode)
-            {
-                dao::$errors['password1'][] = $this->lang->user->weakPassword;
-                return false;
-            }
-
             $user = new stdclass();
             $user->account    = $data->account;
             $user->password   = md5($data->password1);

module/user/js/batchcreate.js

@@ -10,15 +10,26 @@ function changeGroup(role, i)
     }
     $('#group' + i).trigger('chosen:updated');
 }
+
 function toggleCheck(obj, i)
 {
-    if($(obj).val() == '')
+    var $this    = $(obj);
+    var password = $this.val();
+    var $ditto   = $('#ditto' + i);
+    var $passwordStrength = $this.closest('.input-group').find('.passwordStrength');
+    if(password == '')
     {
-        $('#ditto' + i).attr('checked', true);
+        $ditto.attr('checked', true);
+        $ditto.closest('.input-group-addon').show();
+        $passwordStrength.hide();
+        $passwordStrength.html('');
     }
     else
     {
-        $('#ditto' + i).removeAttr('checked');
+        $ditto.removeAttr('checked');
+        $ditto.closest('.input-group-addon').hide();
+        $passwordStrength.html(passwordStrengthList[computePasswordStrength(password)]);
+        $passwordStrength.show();
     }
 }
 

module/user/lang/zh-cn.php

@@ -113,6 +113,7 @@ $lang->user->loginFailed  = "登录失败，请检查您的用户名或密码是
 $lang->user->lockWarning  = "您还有%s次尝试机会。";
 $lang->user->loginLocked  = "密码尝试次数太多，请联系管理员解锁，或%s分钟后重试。";
 $lang->user->weakPassword = "您的密码强度小于系统设定。";
+$lang->user->errorWeak    = "密码不能使用【%s】这些常用弱口令。";
 
 $lang->user->roleList['']       = '';
 $lang->user->roleList['dev']    = '研发';
@@ -171,6 +172,8 @@ $lang->user->error->realname      = "【ID %s】的真实姓名必须填写";
 $lang->user->error->password      = "【ID %s】的密码必须为六位以上";
 $lang->user->error->mail          = "【ID %s】的邮箱地址不正确";
 $lang->user->error->reserved      = "【ID %s】的用户名已被系统预留";
+$lang->user->error->weakPassword  = "【ID %s】的密码强度小于系统设定。";
+$lang->user->error->commonWeak    = "【ID %s】的密码不能使用【%s】这些常用若口令。";
 
 $lang->user->error->verifyPassword   = "验证失败，请检查您的系统登录密码是否正确";
 $lang->user->error->originalPassword = "原密码不正确";

module/user/model.php

@@ -220,12 +220,6 @@ class userModel extends model
             ->remove('group, password1, password2, verifyPassword')
             ->get();
 
-        if(isset($this->config->safe->mode) and $this->computePasswordStrength($this->post->password1) < $this->config->safe->mode)
-        {
-            dao::$errors['password1'][] = $this->lang->user->weakPassword;
-            return false;
-        }
-
         if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand))
         {
             dao::$errors['verifyPassword'][] = $this->lang->user->error->verifyPassword;
@@ -276,17 +270,21 @@ class userModel extends model
             $users->account[$i] = trim($users->account[$i]);
             if($users->account[$i] != '')
             {
-                if(strtolower($users->account[$i]) == 'guest') die(js::error(sprintf($this->lang->user->error->reserved, $i+1)));
+                if(strtolower($users->account[$i]) == 'guest') die(js::error(sprintf($this->lang->user->error->reserved, $i + 1)));
                 $account = $this->dao->select('account')->from(TABLE_USER)->where('account')->eq($users->account[$i])->fetch();
-                if($account) die(js::error(sprintf($this->lang->user->error->accountDupl, $i+1)));
-                if(in_array($users->account[$i], $accounts)) die(js::error(sprintf($this->lang->user->error->accountDupl, $i+1)));
-                if(!validater::checkAccount($users->account[$i])) die(js::error(sprintf($this->lang->user->error->account, $i+1)));
-                if($users->realname[$i] == '') die(js::error(sprintf($this->lang->user->error->realname, $i+1)));
-                if($users->email[$i] and !validater::checkEmail($users->email[$i])) die(js::error(sprintf($this->lang->user->error->mail, $i+1)));
+                if($account) die(js::error(sprintf($this->lang->user->error->accountDupl, $i + 1)));
+                if(in_array($users->account[$i], $accounts)) die(js::error(sprintf($this->lang->user->error->accountDupl, $i + 1)));
+                if(!validater::checkAccount($users->account[$i])) die(js::error(sprintf($this->lang->user->error->account, $i + 1)));
+                if($users->realname[$i] == '') die(js::error(sprintf($this->lang->user->error->realname, $i + 1)));
+                if($users->email[$i] and !validater::checkEmail($users->email[$i])) die(js::error(sprintf($this->lang->user->error->mail, $i + 1)));
                 $users->password[$i] = (isset($prev['password']) and $users->ditto[$i] == 'on' and empty($users->password[$i])) ? $prev['password'] : $users->password[$i];
-                if(!validater::checkReg($users->password[$i], '|(.){6,}|')) die(js::error(sprintf($this->lang->user->error->password, $i+1)));
+                if(!validater::checkReg($users->password[$i], '|(.){6,}|')) die(js::error(sprintf($this->lang->user->error->password, $i + 1)));
                 $role = $users->role[$i] == 'ditto' ? (isset($prev['role']) ? $prev['role'] : '') : $users->role[$i];
 
+                /* Check weak and common weak password. */
+                if(isset($this->config->safe->mode) and $this->computePasswordStrength($users->password[$i]) < $this->config->safe->mode) die(js::error(sprintf($this->lang->user->error->weakPassword, $i + 1)));
+                if(!empty($this->config->safe->changeWeak) and strpos(",{$this->config->safe->weak},", ",{$this->post->password1},") !== false) die(js::error(sprintf($this->lang->user->error->commonWeak, $i + 1, $this->config->safe->weak)));
+
                 $data[$i] = new stdclass();
                 $data[$i]->dept     = $users->dept[$i] == 'ditto' ? (isset($prev['dept']) ? $prev['dept'] : 0) : $users->dept[$i];
                 $data[$i]->account  = $users->account[$i];
@@ -377,12 +375,6 @@ class userModel extends model
             ->remove('password1, password2, groups,verifyPassword')
             ->get();
 
-        if(isset($this->config->safe->mode) and isset($user->password) and $this->computePasswordStrength($this->post->password1) < $this->config->safe->mode)
-        {
-            dao::$errors['password1'][] = $this->lang->user->weakPassword;
-            return false;
-        }
-
         if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand))
         {
             dao::$errors['verifyPassword'][] = $this->lang->user->error->verifyPassword;
@@ -560,12 +552,6 @@ class userModel extends model
             ->remove('account, password1, password2, originalPassword')
             ->get();
 
-        if(isset($this->config->safe->mode) and $this->computePasswordStrength($this->post->password1) < $this->config->safe->mode)
-        {
-            dao::$errors['password1'][] = $this->lang->user->weakPassword;
-            return false;
-        }
-
         if(empty($_POST['originalPassword']) or md5($this->post->originalPassword) != $this->app->user->password)
         {
             dao::$errors['originalPassword'][] = $this->lang->user->error->originalPassword;
@@ -595,12 +581,6 @@ class userModel extends model
         if(!$user) return false;
 
         $password = md5($this->post->password1);
-        if(isset($this->config->safe->mode) and $this->computePasswordStrength($this->post->password1) < $this->config->safe->mode)
-        {
-            dao::$errors['password1'][] = $this->lang->user->weakPassword;
-            return false;
-        }
-
         $this->dao->update(TABLE_USER)->set('password')->eq($password)->autoCheck()->where('account')->eq($this->post->account)->exec();
         return !dao::isError();
     }
@@ -620,6 +600,9 @@ class userModel extends model
         {
             if($this->post->password1 != $this->post->password2) dao::$errors['password'][] = $this->lang->error->passwordsame;
             if(!validater::checkReg($this->post->password1, '|(.){6,}|')) dao::$errors['password'][] = $this->lang->error->passwordrule;
+
+            if(isset($this->config->safe->mode) and $this->computePasswordStrength($this->post->password1) < $this->config->safe->mode) dao::$errors['password1'][] = $this->lang->user->weakPassword;
+            if(!empty($this->config->safe->changeWeak) and strpos(",{$this->config->safe->weak},", ",{$this->post->password1},") !== false) dao::$errors['password1'][] = sprintf($this->lang->user->errorWeak, $this->config->safe->weak);
         }
         return !dao::isError();
     }

module/user/view/batchcreate.html.php

@@ -76,6 +76,7 @@
             <div class='input-group'>
             <?php
             echo html::input("password[$i]", '', "class='form-control' onkeyup='toggleCheck(this, $i)'");
+            echo "<span class='input-group-addon passwordStrength'></span>";
             if($i != 0) echo "<span class='input-group-addon'><input type='checkbox' name='ditto[$i]' id='ditto$i' " . ($i> 0 ? "checked" : '') . " /> {$lang->user->ditto}</span>";
             ?>
             </div>
@@ -116,4 +117,5 @@
   </form>
 </div>
 <?php echo html::hidden('verifyRand', $rand);?>
+<?php js::set('passwordStrengthList', $lang->user->passwordStrengthList)?>
 <?php include '../../common/view/footer.html.php';?>