Please note that the selling, trading, or publicly giving away our invitations — or responding to public invite requests — is strictly forbidden, and may result in you and your entire invite tree being banned. This includes offering to give away our invitations on any forum which is not a class-restricted forum on another private tracker.
diff --git a/sections/user/take_edit.php b/sections/user/take_edit.php
index 86526d88..49ad00a5 100644
--- a/sections/user/take_edit.php
+++ b/sections/user/take_edit.php
@@ -31,7 +31,7 @@
$Val->SetFields('avatar', 0, "regex", "You did not enter a valid avatar URL.", array('regex' => "/^".IMAGE_REGEX."$/i"));
$Val->SetFields('email', 1, "email", "You did not enter a valid email address.");
$Val->SetFields('irckey', 0, "string", "You did not enter a valid IRC key. An IRC key must be between 6 and 32 characters long.", array('minlength' => 6, 'maxlength' => 32));
-$Val->SetFields('new_pass_1', 0, "regex", "You did not enter a valid password. A strong password is 8 characters or longer, contains at least 1 lowercase and uppercase letter, and contains at least a number or symbol.", array('regex' => '/(?=^.{8,}$)(?=.*[^a-zA-Z])(?=.*[A-Z])(?=.*[a-z]).*$/'));
+$Val->SetFields('new_pass_1', 0, "regex", "You did not enter a valid password. A strong password is 8 characters or longer, contains at least 1 lowercase and uppercase letter, and contains at least a number or symbol.", array('regex' => '/(?=^.{8,}$)(?=.*[^a-zA-Z])(?=.*[A-Z])(?=.*[a-z]).*$|.{20,}/'));
$Val->SetFields('new_pass_2', 1, "compare", "Your passwords do not match.", array('comparefield' => 'new_pass_1'));
if (check_perms('site_advanced_search')) {
$Val->SetFields('searchtype', 1, "number", "You forgot to select your default search preference.", array('minlength' => 0, 'maxlength' => 1));
@@ -184,7 +184,9 @@
list($PassHash, $Secret) = $DB->next_record();
if (Users::check_password($_POST['cur_pass'], $PassHash, $Secret)) {
- if ($_POST['new_pass_1'] && $_POST['new_pass_2']) {
+ if ($_POST['cur_pass'] == $_POST['new_pass_1']) {
+ $Err = 'Your new password cannot be the same as your old password.';
+ } else if ($_POST['new_pass_1'] && $_POST['new_pass_2']) {
$ResetPassword = true;
}
} else {
@@ -333,6 +335,7 @@
$ChangerIP = db_string($LoggedUser['IP']);
$PassHash = Users::make_crypt_hash($_POST['new_pass_1']);
$SQL.= ",m.PassHash = '".db_string($PassHash)."'";
+
$DB->query("
INSERT INTO users_history_passwords
(UserID, ChangerIP, ChangeTime)
@@ -365,7 +368,7 @@
$DB->query($SQL);
if ($ResetPassword) {
- logout();
+ logout_all_sessions();
}
header("Location: user.php?action=edit&userid=$UserID");
diff --git a/static/functions/password_validate.js b/static/functions/password_validate.js
index e6cb4f84..df1a58df 100644
--- a/static/functions/password_validate.js
+++ b/static/functions/password_validate.js
@@ -11,6 +11,7 @@ var SHORT = 4;
var MATCH_IRCKEY = 5;
var MATCH_USERNAME = 6;
var COMMON = 7;
+var MATCH_OLD_PASSWORD = 8;
var USER_PATH = "/user.php";
@@ -85,6 +86,7 @@ function validatePassword(password) {
function calculateComplexity(password) {
var length = password.length;
var username;
+ var oldPassword;
if (isUserPage()) {
username = $(".username").text();
@@ -97,12 +99,13 @@ function calculateComplexity(password) {
if (isUserPage()) {
irckey = $("#irckey").val();
+ oldPassword =$("#cur_pass").val();
}
- if (length >= 8) {
+ if (length >= 8 && length < 20) {
setStatus(WEAK);
}
- if (length >= 8 && isStrongPassword(password)) {
+ if ((length >= 8 && isStrongPassword(password)) || length >= 20) {
setStatus(STRONG);
}
if (length > 0 && length < 8) {
@@ -117,6 +120,10 @@ function calculateComplexity(password) {
setStatus(MATCH_IRCKEY);
}
}
+
+ if (oldPassword.length > 0 && password == oldPassword) {
+ setStatus(MATCH_OLD_PASSWORD);
+ }
}
if (username.length > 0) {
if (password.toLowerCase() == username.toLowerCase()) {
@@ -175,6 +182,10 @@ function setStatus(strength) {
disableSubmit();
$("#pass_strength").text("Password is too common").css("color", "red");
}
+ if (strength == MATCH_OLD_PASSWORD) {
+ disableSubmit();
+ $("#pass_strength").text("New password cannot match old password").css("color", "red");
+ }
if (strength == CLEAR) {
$("#pass_strength").text("");
}