0

I'm aware of the Password Policy module that has a number of features for forcing the user to constrain their passwords to certain criteria, but this module does not contain an option to prevent users from including arbitrary strings in their passwords (such as their own username).

Ex. User bob receives a validation error if they try to change their password to anything that includes the string "bob", such as "889bobisthebest99".

Does anyone know how to code custom functionality to achieve this result for Drupal 7.5 or a module that already does what I'm looking for?

  • The answer will depend on the version you're targeting. The 7.x-1.x, 7.x-2.x, & 8.x versions each have their own way of providing extendable constraints. – Shawn Conn Aug 12 '16 at 21:01
0

I found that the Password Policy module actually does have an option to prevent the user from including their username in their password. The broader issue about how to restrict arbitrary strings from a user's password still stands though.

| improve this answer | |
0

The Password Strength module for Drupal 7 offers the closest functionality to what you desire. Full disclosure, I'm the author of the module!

In particular, it utilizes the Zxcvbn-PHP library for discovering patterns in passwords. So, for your example the Zxcvbn-PHP library would detect "bob" and "best" as simple dictionary words in the password and the Password Strength module would report that as a validation error to the user (depending on module settings). Read more about the Zxcvbn-PHP library at https://github.com/bjeavons/zxcvbn-php.

You may be able to configure or hook into the module to further accomplish your goals.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.