Attempting to Limit User Password Length Through PHP Plugins

[Mko]

Hey all,
I'm trying to make it so user passwords need to be at least 6 to 20 characters long.
PHP Plugins:

register_addmember_process
echo strlen($_POST['password']);
echo strlen($vbulletin->GPC['password']);

if (strlen($vbulletin->GPC['password']) < 6) {
$userdata->error('test1');
} else if (strlen($vbulletin->GPC['password']) > 20) {
$userdata->error('fieldmissing');
}

profile_updatepassword_start
echo strlen($_POST['newpassword']);
echo strlen($vbulletin->GPC['newpassword']);

if (strlen($vbulletin->GPC['newpassword']) < 6){
eval(standard_error("Invalid Password. Your password must be at least 6 characters and no more than 20 characters in length."));
} else if (strlen($vbulletin->GPC['newpassword']) > 20) {
eval(standard_error("12"));
}

Now for some reason, every time I execute a plugin, both of the echo statements echo out '0' because supposedly the field I'm calling has no length.

If anyone could help me out and explain what needs to be done to actually obtain the length of the password inputted in the textfield, I'd appreciate it!


Thanks,
Mark

[Simon Lloyd]

Wouldn't you check the register template and evaluate password1.value and password2.value?

[Mko]

Wouldn't you check the register template and evaluate password1.value and password2.value?
I want something that's not able to be changed by the user, meaning nothing in HTML/JS.

[kh99]

I think your problem is that normally the user's browser hashes the password and clears the plain text password field. You can disable that by defining DISABLE_PASSWORD_CLEARING to 1, such as in your config.php or in a plugin:

define('DISABLE_PASSWORD_CLEARING', 1);


or if you wanted you might be able to define it only for the registration and profile pages so that you still have that security feature for normal logins.

[Mko]

I think your problem is that normally the user's browser hashes the password and clears the plain text password field. You can disable that by defining DISABLE_PASSWORD_CLEARING to 1, such as in your config.php or in a plugin:

define('DISABLE_PASSWORD_CLEARING', 1);
or if you wanted you might be able to define it only for the registration and profile pages so that you still have that security feature for normal logins.
Would that lead to potential vulnerabilities and security exploits?

[kh99]

Would that lead to potential vulnerabilities and security exploits?

I don't think so. What it does is it keeps the password from being sent "in the clear". But it doesn't even really protect your forum because if someone were somehow monitoring communications between a users' browser and your forum they could just as easily intercept the hashed password and use it to log in. (but they wouldn't know what the original password was, which I think is the point).