Account Password Vulnerability - enhancing it more?

[Skyrider]

Originally Posted by kh99

You should find a call to fetch_random_password(8) in login.php.

That, I can. But I'm unable to find the letters being used.

$password_characters = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz';

is not found in login.php, as such resetting passwords on the users end (normal recovery) isn't using the password characters through functions.php, I tried and it just gives a normal password with no new characters I added.

[kh99]

Oh, well, you don't find the string of letters there because they should only occur once, in fetch_random_password(), which is called from both places. But if you're not seeing the new chars when you request a password change, then there must be something else going on. I'll take a look and post back if you haven't figured it out by then.

[Skyrider]

I just searched all *.PHP files.. "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwx yz" and or $password_characters is only called in functions.php, so currently no idea where else to look.

[kh99]

Oh, did you actually try requesting a password change? What I was trying to say is that the code in login.php should use the variable with the string of characters that you already changed, so it should change in both cases. If you want to increase the length then you should change login.php where it says fetch_random_password(8) (to something higher than 8).

[Dave]

You need to change the string in the fetch_random_password function because it's not a global variable.

[Skyrider]

Originally Posted by kh99

Oh, did you actually try requesting a password change? What I was trying to say is that the code in login.php should use the variable with the string of characters that you already changed, so it should change in both cases. If you want to increase the length then you should change login.php where it says fetch_random_password(8) (to something higher than 8).

I've changed the password characters within functions.php

$password_characters = '123456789!@#$%^&*()ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz';

Which appears to be working when I use the Check Vulnerable Passwords function. However, when I normally request a new password (forgotten password) for example, I still get the normal ABC,abc passwords, rather than the extra numbers and symbols I placed in.

EDIT!

Nvm! I spoke to soon. It appears to be working after all, thanks folks!

As you requested, your password has now been reset. Your new details are as follows:

Username: skytest
Password: 16%R&EG5pDt(UPX

Honestly, that sounds like a much better / secured password by default.