From 0c6554e03c9527b3e8f08f751ff124e9953ab5ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Mudr=C3=A1k?= Date: Thu, 30 Nov 2017 10:47:57 +0100 Subject: [PATCH] MDL-36056 form: Do not allow passwords with wrapping whitespace This is to avoid accidental misconfiguration while copy/pasting the password value. --- lang/en/form.php | 1 + lib/form/passwordunmask.php | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/lang/en/form.php b/lang/en/form.php index 288c4b64ca8..743a749b05a 100644 --- a/lang/en/form.php +++ b/lang/en/form.php @@ -41,6 +41,7 @@ $string['err_nopunctuation'] = 'You must enter no punctuation characters here.'; $string['err_numeric'] = 'You must enter a number here.'; $string['err_rangelength'] = 'You must enter between {$a->format[0]} and {$a->format[1]} characters here.'; $string['err_required'] = 'You must supply a value here.'; +$string['err_wrappingwhitespace'] = 'The value must not start or end with whitespace.'; $string['err_wrongfileextension'] = 'Some files ({$a->wrongfiles}) cannot be uploaded. Only file types {$a->whitelist} are allowed.'; $string['filesofthesetypes'] = 'Accepted file types:'; $string['filetypesany'] = 'All file types'; diff --git a/lib/form/passwordunmask.php b/lib/form/passwordunmask.php index db18e882be4..224f756e10b 100644 --- a/lib/form/passwordunmask.php +++ b/lib/form/passwordunmask.php @@ -90,4 +90,22 @@ class MoodleQuickForm_passwordunmask extends MoodleQuickForm_password { return $context; } + + /** + * Check that there is no whitespace at the beginning and end of the password. + * + * It turned out that wrapping whitespace can easily be pasted by accident when copying the text from elsewhere. + * Such a mistake is very hard to debug as the whitespace is not displayed. + * + * @param array $value Submitted value. + * @return string|null Validation error message or null. + */ + public function validateSubmitValue($value) { + + if ($value !== trim($value)) { + return get_string('err_wrappingwhitespace', 'core_form'); + } + + return; + } }