Project

General

Profile

Actions
Copy link

Task #100295

closed

Epic #97387: Configurable Password Policies

Prevent setting empty password in backend password recovery

Added by Torben Hansen about 1 year ago. Updated 4 months ago.

Status:
Closed
Priority:
Should have
Assignee:
Torben Hansen
Category:
-
Target version:
12 LTS
Start date:
2023-03-24
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
12
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

If for any reason no password policy is defined in $GLOBALS['TYPO3_CONF_VARS']['BE']['passwordPolicy'], it is possible for a user to submit an empty password, if the required attribute of the new password fields in the password reset form is manually removed. TYPO3 will then save an empty password for the user.

Although it is not possible to login to TYPO3 with an empty password, a fallback check for an empty password must be added to resetPassword in TYPO3\CMS\Backend\Authentication\PasswordReset.

Actions
Copy link

Also available in: Atom PDF