Add missing password restrictions

Author: carlbennett

src/controllers/User/ChangePassword.php

@@ -64,6 +64,28 @@ protected function tryChangePassword(
       $model->error = "PASSWORD_INCORRECT";
       return;
     }
+    $pwlen = strlen($pw2);
+    $req = &Common::$config->bnetdocs->user_register_requirements;
+    $email = Authentication::$user->getEmail();
+    $username = Authentication::$user->getUsername();
+    if (!$req->password_allow_email && stripos($pw2, $email)) {
+      $model->error = "PASSWORD_CONTAINS_EMAIL";
+      return;
+    }
+    if (!$req->password_allow_username && stripos($pw2, $username)) {
+      $model->error = "PASSWORD_CONTAINS_USERNAME";
+      return;
+    }
+    if (is_numeric($req->password_length_max)
+      && $pwlen > $req->password_length_max) {
+      $model->error = "PASSWORD_TOO_LONG";
+      return;
+    }
+    if (is_numeric($req->password_length_min)
+      && $pwlen < $req->password_length_min) {
+      $model->error = "PASSWORD_TOO_SHORT";
+      return;
+    }
     $blacklist = Common::$config->bnetdocs->user_password_blacklist;
     foreach ($blacklist as $blacklist_pw) {
       if (strtolower($blacklist_pw->password) == strtolower($pw2)) {

src/templates/User/ChangePassword.phtml

@@ -20,9 +20,22 @@ switch ($this->getContext()->error) {
   case "NONMATCHING_PASSWORD":
     $message = "The new password does not match its confirmation.";
     break;
+  case "PASSWORD_CONTAINS_EMAIL":
+    $message = "The password contains the email address, "
+      . "use a better password.";
+    break;
+  case "PASSWORD_CONTAINS_USERNAME":
+    $message = "The password contains the username, use a better password.";
+    break;
   case "PASSWORD_INCORRECT":
     $message = "You did not enter your correct current password.";
     break;
+  case "PASSWORD_TOO_LONG":
+    $message = "The password is too long, shorten it.";
+    break;
+  case "PASSWORD_TOO_SHORT":
+    $message = "The password is too short, use a better password.";
+    break;
   case "PASSWORD_BLACKLIST":
     $message = $this->getContext()->error_extra;
     if (empty($message)) $message = "The new password is blacklisted.";