mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-10-29 09:48:32 -04:00
Nic Boet
fd93780425
The login page's change form and the first-run page refused admin as a new password, but the user page (Options, Users, and a user's own page with ZM_USER_SELF_EDIT) and the API (users/add, users/edit) still stored it. Every login then refused that account. Check a new password in one place, passwordProblem() in auth.php, and call it from all four: - includes/actions/user.php, for an admin's edit and a self edit: the save stops with the reason shown on the page. A Password sent as an array is refused too (it reached password_hash() before). - api/app/Model/User.php: an "acceptable" validation rule, so add and edit answer with the reason as the validation message. The API loads no language file, so passwordProblemText() gives it the English. - newPasswordProblem() (both login-page forms) checks the confirmation, then passwordProblem(). Tests: tests/php/test_default_password.php covers passwordProblem() and passwordProblemText().