[PasswordSettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [PasswordSettings] of settings/site.ini.
File
settings/site.ini; override it in settings/override/site.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| RequireLowercase | disabled | The rules a new password must meet (user/password, registration, the user account in content/edit, bin/php/resetuserpassword.php), besides the length ([UserSettings] MinPasswordLength), and what happens after a change. Every rule is off by default: a site keeps the rules it had. Guide: doc/eng-us/features/6.0/modern-password-change.md At least one lowercase letter (any script, not only a-z) |
| RequireUppercase | disabled | At least one uppercase letter |
| RequireDigit | disabled | At least one digit |
| RequireSymbol | disabled | At least one character that is neither a letter nor a digit (a space counts) |
| MinCharacterClasses | 0 | At least this many of the four kinds above (0 to 4; 0 = no such rule) |
| ForbidLogin | disabled | The new password must not contain the user's login name (logins of 3 or more characters) |
| ForbidCurrentPassword | disabled | The new password must differ from the current one |
| EndOtherSessions | enabled | After a password change: the user's other sessions are signed out on their next request (a sign-in keeps a stamp of the password in the session, checked by eZUser::currentUser()); this one stays signed in, with a new session id. The database session handler also deletes them at once. Sessions from before the upgrade (no stamp) and accounts without a password of their own (LDAP, SSO) are not checked. disabled: no stamp, no check, other sessions stay. |
| ChangeNotificationMail | enabled | After a change: mail "your password was changed" to the user (mail category security, essential; template design:user/password_changed_mail.tpl). The mail never contains the password. |
| StrengthMeter | enabled | For the page's script: show the strength meter, offer "Generate a strong password" (its length is [UserSettings] GeneratePasswordLength, at least 12) |
| GenerateButton | enabled |
See also
Generated example: site.ini [PasswordSettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/site.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment