Use password regex to text login password strength

Instead of using a PIN, use the global.password_regex OU setting to
test password strength at login.

Signed-off-by: Jeff Godin <jgodin@tadl.org>

diff --git a/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm b/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm
index e7e6148..03c89dc 100644 (file)
--- a/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm
@@ -625,8 +625,18 @@ sub load_login {
         )
     ];
 
-    # test for four-digit PIN as password -- suggest password change
-    if ($password =~ m/^\d{4}$/) {
+    my $pw_regex = $self->ctx->{get_org_setting}->($org_unit, 'global.password_regex');
+
+    if(!$pw_regex) {
+        # This regex duplicates the JSPac's default "digit, letter, and 7 characters" rule
+        $pw_regex = '(?=.*\d+.*)(?=.*[A-Za-z]+.*).{7,}';
+    }
+
+    # test for password that does not meet regex requirements
+    if ($password !~ m/$pw_regex/) {
+        # redirect user to update_password page with url argument
+        # that can be used by a template to display additional text
+        # suggesting a password change
         my $update_password = sprintf(
                 'https://%s%s/myopac/update_password?initial=1',
                 $self->apache->hostname, $self->ctx->{opac_root} );