Merge pull request #2823 from zlamalp/einfra

CORE: Simplified and fixed einfra password check
CESNET · Jul 29, 2020 · 427bb23 · 427bb23
1 parent c34ccf6
commit 427bb23
Showing 1 changed file with 8 additions and 8 deletions.
diff --git a/.../main/java/cz/metacentrum/perun/core/impl/modules/pwdmgr/EinfraPasswordManagerModule.java b/.../main/java/cz/metacentrum/perun/core/impl/modules/pwdmgr/EinfraPasswordManagerModule.java
@@ -143,14 +143,14 @@ public void checkPasswordStrength(PerunSession sess, String login, String passwo
 			throw new PasswordStrengthException("Password for " + actualLoginNamespace + ":" + login + " is too short. At least 10 characters is required.");
 		}
 
-		String backwardPassword = StringUtils.reverse(password);
-
-		if (password.equalsIgnoreCase(login) ||
-				backwardPassword.equalsIgnoreCase(login) ||
-				password.toLowerCase().contains(login.toLowerCase()) ||
-				backwardPassword.toLowerCase().contains(login.toLowerCase())) {
-			log.warn("Password for {}:{} must not match/contain login or backwards login.", actualLoginNamespace, login);
-			throw new PasswordStrengthException("Password for " + actualLoginNamespace + ":" + login + " must not match/contain login or backwards login.");
+		// if login is at least 3 chars, test if its not contained in password
+		if (login.length() > 2) {
+			String backwardsLogin = StringUtils.reverse(login);
+			if (password.toLowerCase().contains(login.toLowerCase()) ||
+					password.toLowerCase().contains(backwardsLogin.toLowerCase())) {
+				log.warn("Password for {}:{} must not match/contain login or backwards login.", actualLoginNamespace, login);
+				throw new PasswordStrengthException("Password for " + actualLoginNamespace + ":" + login + " must not match/contain login or backwards login.");
+			}
 		}
 
 		// TODO - fetch user and get names to make sure they are not part of password