From 1f5f40b2da617a0f107972c35234895d9003d288 Mon Sep 17 00:00:00 2001 From: asymness Date: Mon, 20 Jun 2022 12:16:42 +0500 Subject: [PATCH] Enforce password length check on reset request (#51005) --- pkg/api/password.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkg/api/password.go b/pkg/api/password.go index 4454a486001..42f7fa722ae 100644 --- a/pkg/api/password.go +++ b/pkg/api/password.go @@ -64,6 +64,11 @@ func (hs *HTTPServer) ResetPassword(c *models.ReqContext) response.Response { return response.Error(400, "Passwords do not match", nil) } + password := models.Password(form.NewPassword) + if password.IsWeak() { + return response.Error(400, "New password is too short", nil) + } + cmd := models.ChangeUserPasswordCommand{} cmd.UserId = query.Result.Id var err error