Ticket #25174: 25174.diff

src/wp-admin/includes/user.php

@@ -370 +370 @@
         printf( '<a href="%s" id="default-password-nag-no">' . __('No thanks, do not remind me again') . '</a>', '?default_password_nag=0' );
         echo '</p></div>';
 }
+
+/**
+ * Creates an array of values that would lower the entropy of a password, and should be lower the score if used
+ *
+ * @return array
+ */
+function zxcvbn_user_input_blacklist() {
+        global $current_user;
+        $strip_chars = array( ' ', '.', '-', ',', '@', 'http://', 'https://', '/' );    // @todo actually, strip out anything that's not [azAZ], and then http(s) ?
+
+        // Generic
+        $blacklist = array( 'WordPress', 'wp', 'blog' );
+
+        // Current user
+        $blacklist = array_merge( $blacklist, array(
+                $current_user->data->user_login,
+                $current_user->data->user_nicename,     // if dupe it'll be removed at end
+                str_replace( $strip_chars, ' ', $current_user->data->user_email ),
+                str_replace( $strip_chars, ' ', $current_user->data->user_url ),
+                get_user_meta( $current_user->data->ID, 'first_name', true ),
+                get_user_meta( $current_user->data->ID, 'last_name', true ),
+                get_user_meta( $current_user->data->ID, 'description', true ),
+        ) );
+
+        // The user currently being edited
+        if ( 'user-edit.php' == basename( $_SERVER['SCRIPT_NAME'] ) && isset( $_GET['user_id'] ) ) {
+                $user_being_edited = get_userdata( (int) $_GET['user_id'] );
+
+                if ( $user_being_edited ) {
+                        $blacklist = array_merge( $blacklist, array(
+                                $user_being_edited->data->user_login,
+                                $user_being_edited->data->user_nicename,
+                                str_replace( $strip_chars, ' ', $user_being_edited->data->user_email ),
+                                str_replace( $strip_chars, ' ', $user_being_edited->data->user_url ),
+                                get_user_meta( $user_being_edited->data->ID, 'first_name', true ),
+                                get_user_meta( $user_being_edited->data->ID, 'last_name', true ),
+                                get_user_meta( $user_being_edited->data->ID, 'description', true ),
+                        ) );
+                }
+        }
+
+        // Current site
+        $blacklist[] = str_replace( $strip_chars, ' ', home_url() );
+        $blacklist[] = str_replace( $strip_chars, ' ', get_bloginfo( 'name' ) );
+        $blacklist[] = str_replace( $strip_chars, ' ', get_bloginfo( 'description' ) );
+        $blacklist[] = str_replace( $strip_chars, ' ', get_bloginfo( 'admin_email' ) );
+
+        // Clean up the results
+        $blacklist_exploded = array();
+        foreach ( $blacklist as $value ) {
+                $blacklist_exploded = array_merge( $blacklist_exploded, explode( ' ', strtolower( $value ) ) );
+        }
+        $blacklist = $blacklist_exploded;
+
+        // todo remove any words that aren't at least 4 chars, otherwise things like "i", "a", "and", etc will hit lots of stuff
+
+        $blacklist = array_unique( $blacklist );
+        $blacklist = array_filter( $blacklist, 'strlen' );      // removes empty and null values
+
+        return apply_filters( 'zxcvbn_user_input_blacklist', $blacklist );
+}
+ No newline at end of file

src/wp-admin/js/password-strength-meter.js

@@ -1 @@
-function passwordStrength(password1, username, password2) {
+/**
+ * Validate a user's new password
+ *
+ * @param string password1 The password
+ * @param string username The username. Deprecated in favor of _zxcvbnSettings.userInputBlacklist
+ * @param string password2 The confirmed password
+ */
+function passwordStrength( password1, username, password2 ) {
         if (password1 != password2 && password2.length > 0)
                 return 5;
-        var result = zxcvbn( password1, [ username ] );
+        var result = zxcvbn( password1, _zxcvbnSettings.userInputBlacklist );
         return result.score;
 }

src/wp-admin/js/user-profile.js

@@ -9 +9 @@
                         return;
                 }
 
-                strength = passwordStrength(pass1, user, pass2);
+                strength = passwordStrength( pass1, '', pass2 );
 
                 switch ( strength ) {
                         case 2:

src/wp-includes/script-loader.php

@@ -312 +312 @@
         $scripts->add( 'zxcvbn-async', "/wp-includes/js/zxcvbn-async$suffix.js", array(), '1.0' );
         did_action( 'init' ) && $scripts->localize( 'zxcvbn-async', '_zxcvbnSettings', array(
                 'src' => includes_url( '/js/zxcvbn.min.js' ),
+                'userInputBlacklist' => zxcvbn_user_input_blacklist(),
         ) );
 
         $scripts->add( 'password-strength-meter', "/wp-admin/js/password-strength-meter$suffix.js", array( 'jquery', 'zxcvbn-async' ), false, 1 );