implement minimal password strength

Author: ylebre

lib/User.php

@@ -78,8 +78,24 @@ private static function isExpired($token) {
 			return true;
 		}
 
+		public static function validatePasswordStrength($password) {
+			// Validate password strength
+			$uppercase = preg_match('@[A-Z]@', $password);
+			$lowercase = preg_match('@[a-z]@', $password);
+			$number    = preg_match('@[0-9]@', $password);
+			$specialChars = preg_match('@[^\w]@', $password);
+
+			if(!$uppercase || !$lowercase || !$number || !$specialChars || strlen($password) < 8) {
+				return false;
+			}
+			return true;
+		}
+
 		public static function createUser($newUser) {
 			self::connect();
+			if (!self::validatePasswordStrength($newUser['password'])) {
+				return false;
+			}
 			$generatedUserId = md5(random_bytes(32));
 			while (self::userIdExists($generatedUserId)) {
 				$generatedUserId = md5(random_bytes(32));
@@ -107,7 +123,10 @@ public static function createUser($newUser) {
 
 		public static function setUserPassword($email, $newPassword) {
 			if (!self::userEmailExists($email)) {
-				return;
+				return false;
+			}
+			if (!self::validatePasswordStrength($newUser['password'])) {
+				return false;
 			}
 			self::connect();
 			$query = self::$pdo->prepare(
@@ -118,6 +137,7 @@ public static function setUserPassword($email, $newPassword) {
 			$queryParams[':passwordHash'] = password_hash($newPassword, PASSWORD_BCRYPT);
 
 			$query->execute($queryParams);
+			return true;
 		}
 
 		public static function allowClientForUser($clientId, $userId) {

www/idp/index.php

@@ -203,6 +203,10 @@
 					];
 
 					$createdUser = User::createUser($newUser);
+					if (!$createdUser) {
+						header("HTTP/1.1 400 Bad Request");
+						exit();
+					}
 					Mailer::sendAccountCreated($createdUser);
 
 					$responseData = array(
@@ -237,7 +241,11 @@
 						header("HTTP/1.1 400 Bad Request");
 						exit();
 					}
-					User::setUserPassword($verifyToken['email'], $_POST['newPassword']);
+					$result = User::setUserPassword($verifyToken['email'], $_POST['newPassword']);
+					if (!$result) {
+						header("HTTP/1.1 400 Bad Request");
+						exit();
+					}
 					header("HTTP/1.1 200 OK");
 					header("Content-type: application/json");
 					echo json_encode("OK");