Reset password: The submit button is enabled when the password input field is empty

[henry.wright]

When resetting a password, the password input field is populated with a strong password suggestion. The submit button is enabled in this case.

If you decide to type a weak password the submit button is disabled and a "Confirm use of weak password" box is shown on the form.

If you remove the password completely so the input field is empty the "Confirm use of weak password" box is removed and the submit button is enabled again.

I think the "Confirm use of weak password" box should be removed but I think the button should remain disabled. This will stop the user submitting an empty form.

Please see the attached images.

[adamsilverstein]

@henrywright Thanks for the bug report! That does seem like unexpected behavior.

I have attempted a fix in 47924.diff​ - in this patch, when the password field is emptied we

• uncheck weak password checkbox
• disable the submit button

I found that the checkbox needed to be unchecked, otherwise as you start typing again the submit button would remain disabled. This feels a little more natural as well - after clearing the field and the checkbox disappears, it seems right that it reappears unchecked.

Can you give this a test?

[henry.wright]

Hi @adamsilverstein

The patch is looking good to me. What are your thoughts on adding an additional password strength state?

I believe we have short, bad, good and strong currently. If we added an empty state we could make use of it in places:

if ( $( passStrength ).is( '.empty, .short, .bad' ) ) {
    // Do something
}

[adamsilverstein]

I believe we have short, bad, good and strong currently. If we added an empty state we could make use of it in places

Interesting suggestion, I can try that out. In this case the behaviour for 'empty' is quite distinct from non empty, so we may want to keep the conditional as it is in the patch,

[adamsilverstein]

In 47924.2.diff​:

• Add a new 'empty' password strength where we were already detecting the empty password field.
• Keep existing logic for disabling submit button, using the 'empty' strength instead of checking the password length (again)

[adamsilverstein]

In 46103:

Login and Registration: reset password - ensure submit button disabled when field empty.

Fix an issue where the submit button was enabled with an empty password when the user previously checked "Confirm use of weak password" for a weak password, then cleared the password field.

Props henry.wright.
Fixes #47924.