[Escalated to 2nd Tier] wpv-reset-password-form does not enforce password strength

[Author]

Posts

[himanshuS]

The wpv-reset-password-form says it will enforce a password with certain characters and numbers but in actuality, it does not. Any password works just fine.

Screenshot - hidden link

Is this a bug? How can I fix this?

[Minesh]

Hello. Thank you for contacting the Toolset support.

Yes, I can see and confirm the issue. I'll escalate it to our next level support. This will be fixed in future but please note that there is no ETA on it.

[Minesh]

The issue is escalated to Devs but please note that there is no ETA on it when the fix will be provided.

For now, as a workaround, you should try to hide the password hint using CSS code or change the password hint using the filter:

add_filter( 'password_hint', 'func_pwd_hint' );
function func_pwd_hint() {
  
  $hint = __( 'Hint: To make it stronger, use upper and lower case letters, numbers, and symbols like ! " ? $ % ^ & ).' );
 
   return $hint;

}

[himanshuS]

Is there a custom way to enforce a strong password?

Your workaround is to change the message but that does not solve the problem of a weak password.

[Minesh]

You should try to use the hook: validate_password_reset
- hidden link

But I see its not working for me. You should file a new feature request for this using the following form:
- https://toolset.com/home/contact-us/suggest-a-new-feature-for-toolset/

[himanshuS]

Thanks. This seems like a basic feature and actually a security issue for all your customers. Having weak passwords, make the whole product vulnerable to attacks. I am not sure how is this not a P1 at your end.

[Minesh]

I understand and nothing much I can do here and that is why I asked you to file a feature request so that you can raise your voice in front of our Product Manager and raise your concern:
- https://toolset.com/home/contact-us/suggest-a-new-feature-for-toolset/

[himanshuS]

Done.

[Jamal]

Minesh is on vacation for a couple of days. Let me follow up with you on this.

At the same time, Minesh has escalated this to our 2nd Tier, who confirms that this was never offered and therefore it is a feature request. He also escalated it to the developers to consider it on an upcoming release. However, we cannot tell when that will be done.

I'll set this ticket as escalated so we can follow up here when the developers provide any feedback.