X-Git-Url: http://git.freeside.biz/gitweb/?p=freeside.git;a=blobdiff_plain;f=FS%2FFS%2FPassword_Mixin.pm;h=b29cf571365fdae310c4e59d85816752c939185b;hp=47290b5fa41f924d41206b3b3f237924c9430558;hb=3adb46fccf9f631e188ea5383bd147b340477639;hpb=9d0796956b83a47a3258e1d388289f6b59f7444d

diff --git a/FS/FS/Password_Mixin.pm b/FS/FS/Password_Mixin.pm
index 47290b5fa..b29cf5713 100644
--- a/FS/FS/Password_Mixin.pm
+++ b/FS/FS/Password_Mixin.pm
@@ -43,20 +43,10 @@ sub is_password_allowed {
   my $self = shift;
   my $password = shift;
 
-  my $cust_main = $self->cust_main;
-
-  # workaround for non-inserted services
-  if ( !$cust_main and $self->get('pkgnum') ) {
-    my $cust_pkg = FS::cust_pkg->by_key($self->get('pkgnum'));
-    $cust_main = $cust_pkg->cust_main if $cust_pkg;
-  }
-  warn "is_password_allowed: no customer could be identified" if !$cust_main;
-  return '' if $cust_main && $conf->config_bool('password-insecure', $cust_main->agentnum);
-
   # basic checks using Data::Password;
   # options for Data::Password
-  $DICTIONARY = 4;   # minimum length of disallowed words
-  $MINLEN = $conf->config('passwordmin') || 6;
+  $DICTIONARY = 0;   # minimum length of disallowed words, false value disables dictionary checking
+  $MINLEN = $conf->config('passwordmin') || 8;
   $MAXLEN = $conf->config('passwordmax') || 12;
   $GROUPS = 4;       # must have all 4 'character groups': numbers, symbols, uppercase, lowercase
   # other options use the defaults listed below:
@@ -65,9 +55,23 @@ sub is_password_allowed {
   # # lists of disallowed words
   # @DICTIONARIES = qw( /usr/share/dict/web2 /usr/share/dict/words /usr/share/dict/linux.words );
 
+  # first, no dictionary checking but require 4 char groups
   my $error = IsBadPassword($password);
-  $error = 'must contain at least one each of numbers, symbols, and lowercase and uppercase letters'
-    if $error eq 'contains less than 4 character groups'; # avoid confusion
+
+  # but they can get away with 3 char groups, so long as they're not using a word
+  if ($error eq 'contains less than 4 character groups') {
+    $DICTIONARY = 4; # default from Data::Password is 5
+    $GROUPS = 3;
+    $error = IsBadPassword($password);
+    # take note--we never actually report dictionary word errors;
+    # 4 char groups is the rule, 3 char groups and no dictionary words is an acceptable exception
+    $error = 'should contain at least one each of numbers, symbols, lowercase and uppercase letters'
+      if $error;
+  }
+
+  # maybe also at some point add an exception for any passwords of sufficient length,
+  # see https://xkcd.com/936/
+
   $error = 'Invalid password - ' . $error if $error;
   return $error if $error;
 
@@ -78,7 +82,9 @@ sub is_password_allowed {
   return '' unless $self->get($self->primary_key); # for validating new passwords pre-insert
 
   #check against customer fields
-  my $cust_main = $self->cust_main;
+  my $cust_main = $self->table eq 'access_user'
+                    ? $self->user_cust_main
+                    : $self->cust_main;
   if ($cust_main) {
     my @words;
     # words from cust_main
@@ -225,6 +231,26 @@ sub insert_password_history {
 
 }
 
+=item delete_password_history;
+
+Removes all password history records attached to this object, in preparation
+to delete the object.
+
+=cut
+
+sub delete_password_history {
+  my $self = shift;
+  my @records = qsearch('password_history', {
+      $self->password_history_key => $self->get($self->primary_key)
+  });
+  my $error = '';
+  foreach (@records) {
+    $error ||= $_->delete;
+  }
+  return $error . ' (clearing password history)' if $error;
+  '';
+}
+
 =item _blowfishcrypt PASSWORD
 
 For internal use: takes PASSWORD and returns a new
@@ -244,6 +270,29 @@ sub _blowfishcrypt {
 
 =back
 
+=head1 CLASS METHODS
+
+=over 4
+
+=item pw_set
+
+Returns the list of characters allowed in random passwords. This is now
+hardcoded.
+
+=cut
+
+sub pw_set {
+
+  # ASCII alphabet, minus easily confused stuff (l, o, O, 0, 1)
+  # and plus some "safe" punctuation
+  split('',
+    'abcdefghijkmnpqrstuvwxyzABCDEFGHIJKLMNPQRSTUVWXYZ23456789#.,[]-_=+'
+  );
+
+}
+
+=back
+
 =head1 SEE ALSO
 
 L<FS::password_history>