SOLVED: Custom authentication pages - backslash in passwords should not be allowed

Bugs
1

WordPress doesn’t support passwords containing a backslash (\).

If a user enters a password containing a backslash on a custom authentication page (e.g. register or reset password), the password they think they set isn’t the one that actually gets saved, so the user will not be able to login.

I think it would be wise to block \ and return a clear validation message, to match WordPress behaviour and avoid confusion.

2

Hi @shane80,

I see. However, I’ve tried to register with a new user and then log in, but I could not replicate the problem with a password that includes a backslash.

If you could show me step-by-step directions (preferably video), how I can replicate this, it would be very helpful for creating internal improvement task.

Thank you.
Matej

3

Hi @Matej!

I believe I’ve identified the issue.

If a user is registered via a Bricks custom registration page, or performs a password reset via a custom reset page, and the password contains a backslash character (\), then…

  • Logging in via a Bricks custom login page works as expected.
  • Logging in via the standard WordPress login page fails due to the backslash character.

Steps to reproduce:

Create two users via a custom registration page:

User 1 with a password of test123\

User 2 with a password of test123

Results:

  • User 1 can log in successfully using the custom login page.
  • User 1 cannot log in using the standard WordPress login page.
  • User 2 can log in successfully on both pages, as the password does not contain a backslash.

This obviously isn’t a major issue, and I only came across it after temporarily disabling the custom login page while troubleshooting a login problem.

4

Hi @shane80,

Thank you so much. After some checking and testing, I was able to replicate this. It turns out that it works if I register the user via the Bricks form and log in via custom login. Or if I register via the default WP registration page and log in via default WP login form, it works.
But not if I mix those two.

I’ve created an internal task, so that we check this out. Meanwhile, if you want to prevent users from using backslash in the password field for registration, you can add regex inside the pattern attribute :slight_smile:

Thank you,
Matej

5

We’ve addressed this in Bricks 2.4-beta (beta release), now available for manual download from your Bricks account.

Please read the changelog entry before testing, and let us know if you experience any issues. Note: beta builds are not recommended for production sites.