In com_users edit.php - the html helper password validation is not taking into account the password complexity that I have setup in the User backend. I have 12 chars minimum, upper, lower and special chars required.

The expected behavior is that the HTML Helper validation uses those settings to set the validation - however, all it does it look for 4 chars minimum.

I found this setting here: media/system/js/fields/validate.js

line 482:

this.setHandler('password', value => {
const regex = /^\S[\S ]{2,98}\S$/;
return regex.test(value);

If I change it to: const regex = /^(?=.*[A-Z].*[A-Z])(?=.*[!@#$&*])(?=.*[0-9].*[0-9])(?=.*[a-z].*[a-z].*[a-z]).{12,}$/;

It does not change the validation behavior on the page.

First - is this a bug? Second - how could I change this to enforce the regex for the password?

  • I don't see any syntactic flaws in your heavier validation pattern. regex101.com/r/SID9Q6/1 Although I find requiring that limited list of symbols to be quite uncommon. Your new pattern with require 12 characters or more, a minimum of 2 uppercase letters, a minimum of 1 of the listed symbols, and a minimum of 3 lowercase letters. I don't see a unicode flag on your pattern. I prefer to use \d rather than [0-9]. I would probably use negated character classes rather than . in the lookaheads. Is it possible that you were merely experiencing a js file caching problem while testing?
    – mickmackusa
    Feb 8 at 6:47


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.