Allow admin to create a password policy #13666
Labels
c: Security
For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
not-in-changelog
For issues or pull requests that should not be included in our release changelog on matomo.org.
Comments
Findus23
added
c: Security
|
It turns out that thanks to the existing event, adding a haveibeenpwned-integration is really easy: |
Findus23
removed
the
c: New plugin
|
@Findus23 like discussed in #14295 I've created new plugin that is available on marketplace: https://github.com/simivar/matomo-password-policy-enforcer |
|
I think with my plugin using haveibeenpwned and @simivar's plugin with common rules and the possibility to easily write a plugin that enforces any arbitrary rule, this should be solved. |
Findus23
added
the
not-in-changelog
|
FYI we're thinking of implementing something simple for password policy in core, see #19961 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
similar to #13070 (show a strength meter in the browser)
At the moment the only limitations for Passwords in Matomo is that it needs to be from 6 to 200 characters long.
matomo/plugins/UsersManager/UsersManager.php
Lines 27 to 28 in b178978
But for organizations who have many employees it might be useful to disallow really weak passwords (123456).
Maybe for the beginning it would be enough to make the
PASSWORD_MIN_LENGTHconfigurable (to avoid having overly complex password rules that force people to write down their passwords)In addition it may be an idea for an plugin that checks all password hashes against https://haveibeenpwned.com/Passwords and disallows ones that are over a set threshold to avoid trivial passwords.
The text was updated successfully, but these errors were encountered: