make minimum entropy configurable, update banned password const

Author: ylebre

config.php.example

@@ -23,14 +23,17 @@
     // won't be locked out after failed login attempts;
     const TRUSTED_IPS = [];
 
+    // Minimum entropy level for a password to be acceptable.
+    const MINIMUM_PASSWORD_ENTROPY = 15;
+
     /**
      * The list is made up of entries from the following sources, and made all lower case:
      *  - https://raw.githubusercontent.com/DavidWittman/wpxmlrpcbrute/master/wordlists/1000-most-common-passwords.txt
      *  - https://nordpass.com/most-common-passwords-list/
      *  - https://www.safetydetectives.com/blog/the-most-hacked-passwords-in-the-world/
      *  - https://www.forbes.com/sites/daveywinder/2019/12/14/ranked-the-worlds-100-worst-passwords/
      */
-    const BANNEDPASSWORDS = [
+    const BANNED_PASSWORDS = [
         '123456',
         'password',
         '12345678',

lib/User.php

@@ -81,8 +81,8 @@ private static function isExpired($token) {
 		}
 
 		public static function validatePasswordStrength($password) {
-			$entropy = PasswordValidator::getEntropy($password, BANNEDPASSWORDS);
-			$minimumEntropy = 50;
+			$entropy = PasswordValidator::getEntropy($password, BANNED_PASSWORDS);
+			$minimumEntropy = MINIMUM_PASSWORD_ENTROPY;
 			if ($entropy < $minimumEntropy) {
 				return false;
 			}