From 9a982cea660dc8b17615c8dc285edaee9c6a55dd Mon Sep 17 00:00:00 2001 From: Thomas Hufschmidt Date: Thu, 13 Aug 2026 17:41:40 +0200 Subject: [PATCH 1/3] Update list of special characters allowed for user password --- .../class.ilSecuritySettingsChecker.php | 33 ++++++++++++++----- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php b/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php index d5ea979eef62..3c579c0aa87a 100755 --- a/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php +++ b/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php @@ -124,23 +124,38 @@ public static function isPassword(string $a_passwd, ?string &$customError = null } /** - * All valid chars for password + * All valid chars for password. + * This also doubles for special character detection * - * @param bool $a_as_regex - * @param bool $a_only_special_chars + * @param bool $a_as_regex Return either for regex testing (default) or GUI output of allowed characters + * @param bool $a_only_special_chars When set, only return special characters * @return string */ - public static function getPasswordValidChars(bool $a_as_regex = true, bool $a_only_special_chars = false): ?string + public static function getPasswordValidChars(bool $a_as_regex = true, bool $a_only_special_chars = false): string { + // Define human-readable special character list for GUI and escape sequence for regex + // Could increase special sysmbol options with: '\p{P}\p{S}' + $specialChars = '_.+?#-*@!$%~/:;=^&{}[]()<>,|\''; + $specialCharsRegex = preg_quote($specialChars, '/'); + + // Return as regex if ($a_as_regex) { + // Special characters only if ($a_only_special_chars) { - return '/[_\.\+\?\#\-\*\@!\$\%\~\/\:\;]+/'; - } else { - return '/^[A-Za-z0-9_\.\+\?\#\-\*\@!\$\%\~\/\:\;]+$/'; + return '/[' . $specialCharsRegex . ']+/'; } - } else { - return 'A-Z a-z 0-9 _.+?#-*@!$%~/:;'; + + // Add ASCII letters and numbers + // Could increase letter set with: '\p{L}\p{N}' + return '/^[A-Za-z0-9' . $specialCharsRegex . ']+$/'; + } + + // Return in human-readable form + $spacedSpecialChars = implode(' ', mb_str_split($specialChars)); + if ($a_only_special_chars) { + return $spacedSpecialChars; } + return 'A-Z a-z 0-9 ' . $spacedSpecialChars; } /** From 064f75da53632de845449c39eb548d4008eef565 Mon Sep 17 00:00:00 2001 From: Thomas Hufschmidt Date: Wed, 2 Sep 2026 12:21:45 +0200 Subject: [PATCH 2/3] Move declare(strict_types=1) so Copyright Check job likes me --- .../classes/class.ilSecuritySettingsChecker.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php b/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php index 3c579c0aa87a..95cb35707889 100755 --- a/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php +++ b/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php @@ -1,7 +1,5 @@ Date: Wed, 2 Sep 2026 14:23:14 +0200 Subject: [PATCH 3/3] Ensure same special-characters for legacy and modern component MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Note: Allowed special characters - _ ~ + * ? ! % # § & $ @ / , . : ; = ^ ( ) { } [ ] < > | ' A note on HasSpecialChars::ALLOWED_CHARS Tried to escape as little as possible to keep readability as much as possible: - Escaped since special inside regex bracked: \ ] - Escaped as regex-border indicator: / - Escaped due to string quotation: ' - Not escaped due to position: - ^ - All other characters have no special meaning inside regex bracked: --- .../classes/class.ilSecuritySettingsChecker.php | 4 +++- components/ILIAS/Refinery/src/Password/HasSpecialChars.php | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php b/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php index 95cb35707889..73c250fe90b7 100755 --- a/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php +++ b/components/ILIAS/PrivacySecurity/classes/class.ilSecuritySettingsChecker.php @@ -135,7 +135,9 @@ public static function getPasswordValidChars(bool $a_as_regex = true, bool $a_on { // Define human-readable special character list for GUI and escape sequence for regex // Could increase special sysmbol options with: '\p{P}\p{S}' - $specialChars = '_.+?#-*@!$%~/:;=^&{}[]()<>,|\''; + // Remember to keep this in line with ILIAS\Refinery\Password\HasSpecialChars::ALLOWED_CHARS + $specialChars = '-_~+*?!%#§&$@/,.:;=^(){}[]<>|\''; + $specialCharsRegex = preg_quote($specialChars, '/'); // Return as regex diff --git a/components/ILIAS/Refinery/src/Password/HasSpecialChars.php b/components/ILIAS/Refinery/src/Password/HasSpecialChars.php index ca004024aeca..3f90114f76c1 100755 --- a/components/ILIAS/Refinery/src/Password/HasSpecialChars.php +++ b/components/ILIAS/Refinery/src/Password/HasSpecialChars.php @@ -25,7 +25,7 @@ class HasSpecialChars extends Constraint { - private const ALLOWED_CHARS = '/[,_.\-#\+\*?!%§\(\)\$]/u'; + private const ALLOWED_CHARS = '/[-_~+*?!%#§&$@\/,.:;=^(){}[\]<>|\']/u'; public function __construct(Data\Factory $data_factory, \ILIAS\Language\Language $lng) {