mirror of
https://github.com/zulip/zulip.git
synced 2026-06-27 21:01:32 +08:00
a116303604
The original "quality score" was invented purely for populating our password-strength progress bar, and isn't expressed in terms that are particularly meaningful. For configuration and the core accept/reject logic, it's better to use units that are readily understood. Switch to those. I considered using "bits of entropy", defined loosely as the log of this number, but both the zxcvbn paper and the linked CACM article (which I recommend!) are written in terms of the number of guesses. And reading (most of) those two papers made me less happy about referring to "entropy" in our terminology. I already knew that notion was a little fuzzy if looked at too closely, and I gained a better appreciation of how it's contributed to confusion in discussing password policies and to adoption of perverse policies that favor "Password1!" over "derived unusual ravioli raft". So, "guesses" it is. And although the log is handy for some analysis purposes (certainly for a graph like those in the zxcvbn paper), it adds a layer of abstraction, and I think makes it harder to think clearly about attacks, especially in the online setting. So just use the actual number, and if someone wants to set a gigantic value, they will have the pleasure of seeing just how many digits are involved. (Thanks to @YJDave for a prototype that the code changes in this commit are based on.)
79 lines
3.3 KiB
HTML
79 lines
3.3 KiB
HTML
{% extends "zerver/portico_signup.html" %}
|
|
{% block customhead %}
|
|
{{ super() }}
|
|
{{ render_bundle('zxcvbn') }}
|
|
{% endblock %}
|
|
|
|
{% block portico_content %}
|
|
|
|
<div class="password-container flex full-page new-style">
|
|
|
|
<!-- wrapper for flex content -->
|
|
<div>
|
|
<div class="get-started">
|
|
<h1>{{ _('Reset your password.') }}</h1>
|
|
</div>
|
|
<div class="password-reset white-box">
|
|
<!-- TODO: Ask about meta viewport 1:1 scaling -->
|
|
|
|
{% if validlink %}
|
|
<form method="post" id="password_reset" class="form-horizontal" autocomplete="off">
|
|
{{ csrf_input }}
|
|
<div class="input-box" id="email-section">
|
|
<label for="id_email">{{ _("Email") }}</label>
|
|
<div>
|
|
<input type="text" name="name" placeholder='{{ form.user.email }}' disabled />
|
|
</div>
|
|
</div>
|
|
|
|
<div class="input-box">
|
|
<label for="id_new_password1" class="">{{ _('Password') }}</label>
|
|
<input id="id_new_password1" class="required" type="password" name="new_password1"
|
|
value="{% if form.new_password1.value() %}{{ form.new_password1.value() }}{% endif %}"
|
|
maxlength="100"
|
|
data-min-length="{{password_min_length}}"
|
|
data-min-guesses="{{password_min_guesses}}" required />
|
|
{% if form.new_password1.errors %}
|
|
{% for error in form.new_password1.errors %}
|
|
<div class="alert alert-error">{{ error }}</div>
|
|
{% endfor %}
|
|
{% endif %}
|
|
</div>
|
|
<div class="input-box">
|
|
<div class="">
|
|
<div class="progress" id="pw_strength">
|
|
<div class="bar bar-danger" style="width: 10%;"></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="input-box">
|
|
<label for="id_new_password2" class="">{{ _('Confirm password') }}</label>
|
|
<input id="id_new_password2" class="required" type="password" name="new_password2"
|
|
value="{% if form.new_password2.value() %}{{ form.new_password2.value() }}{% endif %}"
|
|
maxlength="100" required />
|
|
{% if form.new_password2.errors %}
|
|
{% for error in form.new_password2.errors %}
|
|
<div class="alert alert-error">{{ error }}</div>
|
|
{% endfor %}
|
|
{% endif %}
|
|
</div>
|
|
|
|
<div class="input-box m-t-30">
|
|
<div class="centered-button">
|
|
<button type="submit" class="" value="Submit">Submit</button>
|
|
</div>
|
|
</div>
|
|
</form>
|
|
|
|
<script type="text/javascript">
|
|
common.autofocus('#id_new_password1');
|
|
</script>
|
|
{% else %}
|
|
<p>{{ _('Sorry, the link you provided is invalid or has already been used.') }}</p>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
{% endblock %}
|