Loading...
 
Skip to main content

Bug in calculating password strength

  • Tracker item actions
Trackers
Items
Status
Pending
Subject
Bug in calculating password strength
Version
27.x
29.x
30.x
31.x (future, currently trunk)
4.x
Category
  • Regression
Feature
User Administration (Registration, Login & Banning)
Resolution status
Partially solved
Submitted by
edwinbennink
Lastmod by
joel.magene
Rating
(0)
Description

The number count in a password is rated using this piece of code in lib/tiki-js.js:

// Numbers
var nNumberCount = countContain(strPassword, m_strNumber);
// — 1 number
if (nNumberCount == 1)
{
nScore += 10;
}
// — 3 or more numbers
if (nNumberCount >= 3)
{
nScore += 20;
}

This causes a password with 1 number to get 10 points extra, a password with 2 numbers extra points, and a password with 3 or more numbers 20 extra points.

EDIT @joel.magene 2026/06/02:
Current master still miscalculates password number scoring, but differently from the original report.

In lib/tiki-js.js, the current fallback branch gives +10 points when nNumberCount is less than 3, including when it is 0. This means passwords with no digits are overrated.

Expected:
0 digits = +0
1-2 digits = +10
3+ digits = +20

Fix: only apply the +10 fallback when nNumberCount > 0.

Solution

Better change it into something like this:

// Numbers
var nNumberCount = countContain(strPassword, m_strNumber);
// — 1 number
if (nNumberCount > 0)
{
nScore += 10;
}
// — 3 or more numbers
if (nNumberCount >= 3)
{
nScore += 10;
}

Workaround
Importance
3
Priority
15
Demonstrate Bug on Tiki 19+
Demonstrate Bug (older Tiki versions)
Ticket ID
3460
Created
Wednesday 30 June, 2010 14:44:35 UTC
by edwinbennink
LastModif
Tuesday 02 June, 2026 20:05:47 UTC


Show PHP error messages