How does Plone allow addons to implement password policies?

CorySanin · November 13, 2018, 10:08pm

I've seen two different addons monkeypatch Products.CMFPlone.RegistrationTool.RegistrationTool.testPasswordValidity in order to introduce password policies to Plone. Isn't that what Products.PluggableAuthService.interfaces.plugins.IValidationPlugin is for? If so, does Plone/PlonePAS utilize the IValidationPlugin? I don't think it should be necessary to monkeypatch anything to add new password policies.

tkimnguyen · November 15, 2018, 12:38pm

@jensens ping

djay · November 16, 2018, 3:40am

@CorySanin Yes it does, after a certain version. I made a plone core change years ago to make sure it does. You can see it being used here in the plugin I wrote.

github.com

collective/Products.PasswordStrength/blob/master/Products/PasswordStrength/plugin.py

"""PasswordStrength.
    Rejects passwords which aren't strong enough
"""

__author__ = "Dylan Jay <software@pretaweb.com>"

import logging

from AccessControl import ClassSecurityInfo
from Globals import InitializeClass
from OFS.Cache import Cacheable

from Products.CMFPlone.RegistrationTool import RegistrationTool
from Products.CMFPlone import PloneMessageFactory as _p
from . import _
from Products.PluggableAuthService.plugins.BasePlugin import BasePlugin
from Products.PluggableAuthService.utils import classImplements
from Products.PluggableAuthService.interfaces.plugins import IValidationPlugin
import re
from zope.i18n import translate

This file has been truncated. show original

I don't know why other plugins continue to monkey patch.

CorySanin · November 19, 2018, 11:34pm

Thank you for the response and example!