[xwiki-users] Disable password change
We'd like to disable the ability for a user to change their password (to prevent easy passwords from being used). I could just edit XWikiUserSheet and take out the "change password" link, but a user could easily find out that changing the password could be done by typing in the appropriate URL. Is there a better way to disable the change password page? Thanks, Trevor
Wouldn't it be better to set up some password testing instead. Eg. If password doesn't contain a capital letter and a small letter and a number then refuse change. It's properly the same amount of work, and it allows your users to change the password regularly (you might even force that). -Rune -----Oprindelig meddelelse----- Fra: [email protected] [mailto:[email protected]] På vegne af Trevor Russ Sendt: 10. september 2009 17:02 Til: XWiki Users Emne: [xwiki-users] Disable password change We'd like to disable the ability for a user to change their password (to prevent easy passwords from being used). I could just edit XWikiUserSheet and take out the "change password" link, but a user could easily find out that changing the password could be done by typing in the appropriate URL. Is there a better way to disable the change password page? Thanks, Trevor _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
Rune, Thanks for the idea, yes that would work too! With that thought, I have found "passwd.vm" and it looks like I can just put the validation in there. I take it ".vm" files are Velocity macros, with a little javascript thrown in? Not that I know either, but it doesn't look too difficult. Thanks again for the pointer, Trevor On Fri, 11 Sep 2009 11:12:35 +0200 Rune Hylleberg wrote:
Wouldn't it be better to set up some password testing instead. Eg. If password doesn't contain a capital letter and a small letter and a number then refuse change.
It's properly the same amount of work, and it allows your users to change the password regularly (you might even force that).
OK, thanks again for the inspiration Rune. I found a decent open-source password validation script in javascript. I'll stitch it in and see how it works... Trevor
Well glad I could help, But javascript only goes so far. For real protection (or paranoid admins) it should also be done at the server, or better at database level. I know most other auth services does this, and for everybody using them the problem is solved. So for the development team, if you would like to make this a real stand-alone wiki/cms-system, it's a small effort to make a strong selling point, - another line in the feature list, etc. -Rune -----Oprindelig meddelelse----- Fra: [email protected] [mailto:[email protected]] På vegne af Trevor Russ Sendt: 11. september 2009 15:01 Til: XWiki Users Emne: Re: [xwiki-users] Disable password change OK, thanks again for the inspiration Rune. I found a decent open-source password validation script in javascript. I'll stitch it in and see how it works... Trevor _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
participants (2)
-
Rune Hylleberg -
Trevor Russ