special character / symbols in passwords

[vanthien]

Password rejections have been a bit of a problem on my new website, where several individuals encountered problems with registering. Searching the forums I've found some discussion, but no answers. The topics are locked, so I'm posting this separately.

The password requirements on my site are:
12 or more characters,
including 2 each of lower case, upper case, numbers and symbols.

After some experimenting, trial and error, I believe I've come up with the reason for the annoying rejections.
As far as I can determine, acceptable symbols are:
! # $ % & * ( ) _ - + = : ; ?

NOT usable symbols:
@ ^ + ~ “ ‘ / \ | . > , < and spaces.

For what it's worth.
Frank :-)

[ceford]

Reported as a bug in September 2023: https://issues.joomla.org/tracker/joomla-cms/41552

[vanthien]

If this was reported 5 months ago, how long can it take before it is included in an update?
I have just launched my website, giving registrants careful instructions which symbols to use and which not to use, and find that most registrants still run into trouble registering and I have to rescue them manually. Maybe they hit the Register button before verifying that their password was accepted, but they get an entry in the list of users, blocked and inactive, after which they can't do anything anymore until I am alerted to the entry and manually Activate them. It's a real nuisance and I'd love to see a fix for this.

[MJO_SWUK]

I'm also having problems with this.
Existing passwords with "illegal" symbols still seem to work, but not for any new users.
Is it known where the "allowed" and "not allowed" special symbols are stored so that this can be manually updated pending a fix.
Is it in the DB or in code?

[ceford]

You should read the bug report. The location and a potential solution are there. The solution would have to go in the js, min.js and min.js.gz files.

[brian]

I have created a fix for this. It needs testing https://github.com/joomla/joomla-cms/pull/43484

[JAVesey]

I have created a fix for this. It needs testing https://github.com/joomla/joomla-cms/pull/43484

@brian
Thank you for this.

@ceford
I see you’ve tested the file but I can’t find the passwordstrength.es6.js file in my installation (J5.1.0). Can you point me in the right direction, please

[ceford]

I am using a clone of the repo - go to the GitHub site, https://github.com/joomla/joomla-cms, select the 5.1-dev branch and follow the instructions near the bottom of the page. You have to run npm ci to recompile the js files.