[Resolved] wpv-reset-password-form shortcode

[Author]

Posts

[sergioC-13]

Hello (its me again)
I am trying to:
i've been using the follow toolset shortcodes: user login, recovery password and password reset.
My problem is that the password reset form is not validating the minimum characters imposed through the wordpress "validate_password_reset" hook. Which means that if a user resets a two-character password, you can do it.
While, if the operation is carried out from wp-login.php, it is validated and the user cannot enter a password of less than 8 characters
I expected to :
user must set a password with a min length of 8 characters
Instead, I got:
no validation.
Thank you for your time.
The hook im using is :

add_action('validate_password_reset','geek_validate_password_reset',10,2);
function geek_validate_password_reset($errors, $user){
$exp = '/^(?=.*[A-Za-z])(?=.*[A-Z])(?=.*[@$!%*#?&])[A-Za-z\d@$!%*#?&]{8,20}$/';

if(strlen($_POST['pass1']) < 8 || !preg_match($exp, $_POST['pass1']) ){
$errors->add( 'error', 'Hint: Password length must be minimum 8 characters and maximum 20, and must contain at least one capital letter, number and punctuation mark.','');
}
}

[Waqar]

Hi,

Thank you for contacting us and I'd be happy to assist.

Your observation is correct and the validation rule added through the "validate_password_reset" hook works as expected with the WordPress default password reset form, but not with the one added through the Toolset.

We already have an internal ticket to add support for a validation feature like this and I've added your voice to this matter too.

For now, a workaround can be to replace the custom page password reset page (that holds the [wpv-reset-password-form] shortcode) with the WordPress default password reset form.

To do this please make sure that wherever you're using the "[wpv-forgot-password-form]" shortcode ( ref: https://toolset.com/documentation/user-guides/views-shortcodes/#vf-428134 ), you're not including the "reset_password_url" attribute that generates the password reset link sent in the email and redirects to the custom "Password Reset" page of your website.
( as a result, the password reset link will use the WordPress default password reset form link )

Another alternative can be to use script-based, password validation on your custom password reset form. You'll find a number of script examples and guides on the topic online, similar to:
hidden link

I hope this helps and please let me know if you need any further assistance around this.

regards,
Waqar

[sergioC-13]

Thank you Waqar for your response, my issue is resolved now after follow the link you share. I hope in the future we can validate this form without use the wp-login.php file directly. Thank you!