TryGhost / Ghost-Admin / 3177

70%

push

travis-ci

Match client-side password validation to new server-side rules (#899)

refs TryGhost/Ghost#9150

- added a new validator for password validations that will take care of the rules client side
- Passwort rules added:
   - Disallow obviously bad passwords: 1234567890, qwertyuiop, asdfghjkl; and asdfghjklm
   - Disallow passwords that contain the words "password" or "ghost"
   - Disallow passwords that match the user's email address
   - Disallow passwords that match the blog domain or blog title
   - Disallow passwords that include 50% or more of the same characters: 'aaaaaaaaaa', '1111111111' and 'ababababab' for example.
- When changing the own password, the old password is not affected by the new validations
- Validation are running on
   - setup
   - signup
   - password change in Team - User (only new passwords are validated)
   - passwort reset

1629 of 2503 branches covered (65.08%)

51 of 51 new or added lines in 5 files covered. (100.0%)

3879 of 5327 relevant lines covered (72.82%)

41.94 hits per line