Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

String Sanitation - Password reset #1558

Closed
dpalomino opened this issue Jun 5, 2017 · 1 comment
Closed

String Sanitation - Password reset #1558

dpalomino opened this issue Jun 5, 2017 · 1 comment

Comments

@dpalomino
Copy link

Thanks @linzjax for detecting this. Issuing individual issues from the comments in PR #1395.

Steps To Reproduce:

  1. Go to password reset process
  2. I can reset my password to contain an emoji
@amplifi
Copy link
Contributor

amplifi commented Jun 6, 2017

This is expected behavior and a good thing.

Passwords are encrypted when stored in the database, and they aren't accessed by any other component of the platform aside from Django's auth module. So as long as the characters are Unicode (which emoji are), it's totally fine. Restricting emoji would actually restrict the overall range of possible characters in a password, and make the passwords relatively less secure.

@amplifi amplifi closed this as completed Jun 6, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants