[Done 1.3.9] Password change

[cochlear]

ZC 1.3.8a

This is what I've found.

Admin initially allows a minimum of say, 0 characters for password.

The customer sets a 3-character password.

Then admin increases the minimum to 4 characters.

Customer can still log in, but if she wants to change her password to more characters, say 5, she will get a error popup message saying password requires a minimum of 4 characters. No doubt the customer will feel a bit confused.

I'm guessing it's because the script checks the length of old password. If so, then I think it would be better if the script checks the new password instead.

[DrByte]

I'm not sure why you're suggesting there is a bug.

1. A fresh new install of Zen Cart requires minimum password length of 5.
2. If the administrator changes that value after customers have created passwords, do you want all the passwords to suddenly be invalid?
3. The "minimum characters" check is done against the new password selected, so that the user cannot enter a password shorter than the required minimum length in effect at the time they are changing their password.

[cochlear]

3. The "minimum characters" check is done against the new password selected, so that the user cannot enter a password shorter than the required minimum length in effect at the time they are changing their password.

I agree it should work that way. But as I described in the process above, the new password that I tried is longer than the required minimum, but ZC is still blocking it.

See the screen capture below. The new password has 5 dots, but the error message is referring to 4 characters.

Anyway I realise this scenario should not arise too frequently, so it's no big deal. I was just reporting it in case someone might be interested.

[DrByte]

Hmmm ... well lo and behold ... a bug

You're right. I was sure I'd tested that, but it's clear I hadn't.

A quick-fix is to edit the /includes/modules/pages/account_password/jscript_form_check.php and change this line:

    if (password_current == '' || password_current.length < field_size) {

to this:

    if (password_current == '' ) {