Added system settings option to require passwords of a set minimum length.

This setting affects User passwords, Phone and Server registration passwords and the System Settings default passwords.

git-svn-id: svn://192.168.202.10@3196 3d104415-ff17-0410-8863-d5cf3c621b8a

UPGRADE

@@ -474,6 +474,10 @@ OTHER CHANGES:
 	that use an OpenSIPs server to route outbound calls where this feature
 	has been enabled.
 
+133. Added system settings option to require passwords of a set minimum length.
+	This setting affects User passwords, Phone and Server registration 
+	passwords and the System Settings default passwords.
+
 
 
 

extras/MySQL_AST_CREATE_tables.sql

@@ -1845,7 +1845,8 @@ call_quota_lead_ranking ENUM('0','1','2') default '0',
 enable_second_script ENUM('0','1') default '0',
 enable_first_webform ENUM('0','1') default '1',
 recording_buttons VARCHAR(30) default 'START_STOP',
-opensips_cid_name ENUM('0','1') default '0'
+opensips_cid_name ENUM('0','1') default '0',
+require_password_length TINYINT(3) UNSIGNED default '0'
 ) ENGINE=MyISAM;
 
 CREATE TABLE vicidial_campaigns_list_mix (
@@ -4590,4 +4591,4 @@ INSERT INTO vicidial_settings_containers(container_id,container_notes,container_
 
 UPDATE system_settings set vdc_agent_api_active='1';
 
-UPDATE system_settings SET db_schema_version='1586',db_schema_update_date=NOW(),reload_timestamp=NOW();
+UPDATE system_settings SET db_schema_version='1587',db_schema_update_date=NOW(),reload_timestamp=NOW();

extras/upgrade_2.14.sql

@@ -1168,3 +1168,7 @@ ALTER TABLE system_settings ADD opensips_cid_name ENUM('0','1') default '0';
 ALTER TABLE vicidial_campaigns ADD opensips_cid_name VARCHAR(15) default '';
 
 UPDATE system_settings SET db_schema_version='1586',db_schema_update_date=NOW() where db_schema_version < 1586;
+
+ALTER TABLE system_settings ADD require_password_length TINYINT(3) UNSIGNED default '0';
+
+UPDATE system_settings SET db_schema_version='1587',db_schema_update_date=NOW() where db_schema_version < 1587;

www/vicidial/admin_header.php

@@ -1,7 +1,7 @@
 <?php
 # admin_header.php - VICIDIAL administration header
 #
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 # 
 
 # CHANGES
@@ -80,6 +80,7 @@
 # 190121-1803 - Added special streamlined header option for mobile devices
 # 190530-1013 - Added javascript for active list change feature
 # 191028-1739 - Added VM Message Groups
+# 200206-2314 - Added password length indicator
 #
 
 $stmt="SELECT admin_home_url,enable_tts_integration,callcard_enabled,custom_fields_enabled,allow_emails,level_8_disable_add,allow_chats,enable_languages,admin_row_click,admin_screen_colors,user_new_lead_limit,user_territories_active,qc_features_active,agent_soundboards,enable_drop_lists,allow_ip_lists from system_settings;";
@@ -652,10 +653,12 @@ if ( ( ($ADD==34) or ($ADD==31) or ($ADD==49) ) and ($SUB==29) and ($LOGmodify_c
 	var strong = new Image();
 	strong.src = "images/strong.png";
 
-	function pwdChanged(pwd_field_str, pwd_img_str) 
+	function pwdChanged(pwd_field_str, pwd_img_str, pwd_len_field, pwd_len_min) 
 		{
 		var pwd_field = document.getElementById(pwd_field_str);
+		var pwd_field_value = pwd_field.value;
 		var pwd_img = document.getElementById(pwd_img_str);
+		var pwd_len = pwd_field_value.length
 
 	//	var strong_regex = new RegExp( "^(?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])", "g" );
 	//	var medium_regex = new RegExp( "^(?=.{6,})(((?=.*[a-z])(?=.*[A-Z]))|((?=.*[a-z])(?=.*[0-9]))|((?=.*[A-Z])(?=.*[0-9]))).*$", "g" );
@@ -677,6 +680,10 @@ if ( ( ($ADD==34) or ($ADD==31) or ($ADD==49) ) and ($SUB==29) and ($LOGmodify_c
 			if (pwd_img.src != weak.src) 
 				{pwd_img.src = weak.src;}
 			}
+		if ( (pwd_len_min > 0) && (pwd_len_min > pwd_len) )
+			{document.getElementById(pwd_len_field).innerHTML = "<font color=red><b>" + pwd_len + "</b></font>";}
+		else
+			{document.getElementById(pwd_len_field).innerHTML = "<font color=black><b>" + pwd_len + "</b></font>";}
 		}
 
 	function openNewWindow(url) 

www/vicidial/help_documentation.txt

@@ -1,4 +1,4 @@
-# version: 20200204234401
+# version: 20200206220601
 users-user	User ID	<QXZ>This field is where you put the users ID number, can be up to 8 digits in length, Must be at least 2 characters in length.</QXZ>
 users-pass	Password	<QXZ>This field is where you put the users password. Must be at least 2 characters in length. A medium strength user password will be at least 10 characters in length, and a strong user password will be at least 20 characters in length and have letters as well as at least one number. It is recommended that you use a longer password if possible, stringing together several unrelated words with no spaces, and a number somewhere in the string. The maximum size of a password is 100 characters.</QXZ>
 users-force_change_password	Force Change Password	<QXZ>If this option is set to Y then the user will be prompted to change their password the next time they log in to the administration webpage. Default is N.</QXZ>
@@ -1078,6 +1078,7 @@ settings-recording_buttons	Recording Buttons Type	<QXZ>This option allows you to
 settings-mute_recordings	Allow Mute Recordings	<QXZ>This option if enabled allows you to enable the MUTE RECORDING button on the agent screen by campaign and-or user. This feature is only tested with systems running Asterisk 13. You should not mute recordings for more than 15 minutes at a time. Default is 0 for disabled.</QXZ>
 settings-enable_auto_reports	Enable Automated Reports	<QXZ>This option if enabled allows you access to the Automated Reports section where you can set up reports to run at scheduled times and be delivered by email or FTP. Default is 0 for disabled.</QXZ>
 settings-first_login_trigger	First Login Trigger	<QXZ>This setting allows for the initial configuration of the server screen to be shown to the administrator when they first log into the system.</QXZ>
+settings-require_password_length	User Password Minimum Length	<QXZ>If set above 0, this setting will require that user passwords, phone and server passwords, and system settings default passwords be at least this minimum length of characters when those records settings are modified on the Modify pages. The most important factor in password security is the length of the password, and user passwords in this system can be up to 100 characters in length. Default is 0 for disabled.</QXZ>
 settings-default_phone_registration_password	Default Phone Registration Password	<QXZ>This is the default registration password used when new phones are added to the system. Default is test.</QXZ>
 settings-default_phone_login_password	Default Phone Login Password	<QXZ>This is the default phone web login password used when new phones are added to the system. Default is test.</QXZ>
 settings-default_server_password	Default Server Password	<QXZ>This is the default server password used when new servers are added to the system. Default is test.</QXZ>