0

I'm referencing the below solution (which came from here Force Password Complexity) to enforce a certain level of password security. It works as expected, but it is running for ALL user roles. I do not want to enforce the same parameters to the basic 'subscriber' role. How do I block the code from running for certain roles? (Or, force it to run for certain roles such as Administrator, Editor, etc.)

add_action('user_profile_update_errors', 'validateProfileUpdate', 10, 3 );
add_filter('registration_errors', 'validateRegistration', 10, 3 );
add_action('validate_password_reset', 'validatePasswordReset', 10, 2 );

function validateProfileUpdate( WP_Error &$errors, $update, &$user ) {
    return validateComplexPassword( $errors );
}

function validateRegistration( WP_Error &$errors, $sanitized_user_login, $user_email ) {
    return validateComplexPassword( $errors );
}

function validatePasswordReset( WP_Error &$errors, $userData ) {
    return validateComplexPassword( $errors );
}

function validateComplexPassword( $errors ) {

    $password = ( isset( $_POST[ 'pass1' ] ) && trim( $_POST[ 'pass1' ] ) ) ? $_POST[ 'pass1' ] : null;

    if ( empty( $password ) || ( $errors->get_error_data( 'pass' ) ) )
        return $errors;

    $passwordValidation = validatePassword($password);

    if ( $passwordValidation !== true ) {
        $errors->add( "pass", "<strong>ERROR</strong>: " . $passwordValidation . "." );
    }

    return $errors;
}

function validatePassword($Password) {
    
    //#### Check it's greater than 6 Characters
    if (strlen($Password) < 6) {
        return "Password is too short (" . strlen($Password) . "), please use 6 characters or more.";
    }

    //#### Test password has uppercase and lowercase letters
    if (preg_match("/^(?=.*[a-z])(?=.*[A-Z]).+$/", $Password) !== 1) {
        return "Password does not contain a mix of uppercase & lowercase characters.";
    }

    //#### Test password has mix of letters and numbers
    if (preg_match("/^((?=.*[a-z])|(?=.*[A-Z]))(?=.*\d).+$/", $Password) !== 1) {
        return "Password does not contain a mix of letters and numbers.";
    }

    //#### Password looks good
    return true;

}

1 Answer 1

0

You can exclude certain roles like this:

1- Create a function to check if the current user role is excluded:

function isPasswordValidationSkipped()
{
    // Fill this array with roles that you want to exclude from password validation
    $excludedRoles = ['subscriber'];

    $user = wp_get_current_user();
    foreach ($user->roles as $role) {
        if(in_array($role, $excludedRoles)) {
            return true;
        }
    }
    return false;
}

2- Then use that function inside "validateComplexPassword" Like this:

function validateComplexPassword( $errors ) {

    $password = ( isset( $_POST[ 'pass1' ] ) && trim( $_POST[ 'pass1' ] ) ) ? $_POST[ 'pass1' ] : null;

    if ( true === isPasswordValidationSkipped() || empty( $password ) || ( $errors->get_error_data( 'pass' ) ) )
        return $errors;

    $passwordValidation = validatePassword($password);

    if ( $passwordValidation !== true ) {
        $errors->add( "pass", "<strong>ERROR</strong>: " . $passwordValidation . "." );
    }

    return $errors;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.