Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

パスワードの文字列強化 #293

Merged
merged 6 commits into from
Jul 30, 2019
Merged

パスワードの文字列強化 #293

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ee4adeb
パスワードの文字列強化
nanasess Jul 24, 2019
3664f89
Fix Cannot declare class Autoloading_SC_Product
nanasess Jul 2, 2019
ccb0980
パスワードに記号も含められるよう修正
nanasess Jul 25, 2019
ee22786
テストケース追加
nanasess Jul 25, 2019
0a8ea85
会員登録テストのパスワードを修正
nanasess Jul 25, 2019
4607214
パスワードに数字が含まれない場合があるのを修正
nanasess Jul 25, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions ctests/acceptance/EntryCept.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
$I->resetEmails();

$new_email = microtime(true).'.'.$faker->safeEmail;
$password = $faker->password(8, 100).'1';

$I->wantTo('会員登録が正常にできるかを確認する');
$I->amOnPage('/entry/kiyaku.php');
Expand All @@ -29,8 +30,8 @@
'tel03' => '111',
'email' => $new_email,
'email02' => $new_email,
'password' => 'password',
'password02' => 'password',
'password' => $password,
'password02' => $password,
'sex' => (string) $faker->numberBetween(1, 2),
'reminder' => (string) $faker->numberBetween(1, 7),
'reminder_answer' => $faker->word,
Expand Down
2 changes: 1 addition & 1 deletion data/Smarty/templates/admin/system/input.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ self.moveTo(20,20);self.focus();
<!--{if $arrErr.password}--><span class="attention"><!--{$arrErr.password}--><!--{$arrErr.password02}--></span><!--{/if}-->
<input type="password" name="password" size="20" class="box20" value="<!--{$arrForm.password}-->" onfocus="<!--{$tpl_onfocus}-->" maxlength="<!--{$smarty.const.STEXT_LEN}-->" style="<!--{$arrErr.password|sfGetErrorColor}-->" />
<span class="attention">※必須入力</span><br />
※半角英数字<!--{$smarty.const.ID_MIN_LEN}-->～<!--{$smarty.const.ID_MAX_LEN}-->文字（記号可）
※半角英数字<!--{$smarty.const.PASSWORD_MIN_LEN}-->～<!--{$smarty.const.PASSWORD_MAX_LEN}-->文字（記号可）
<br />
<input type="password" name="password02" size="20" class="box20" value="<!--{$arrForm.password02}-->" onfocus="<!--{$tpl_onfocus}-->" maxlength="<!--{$smarty.const.STEXT_LEN}-->" style="<!--{$arrErr.password02|sfGetErrorColor}-->" />
<p><span class="attention mini">確認のために2度入力してください。</span></p>
Expand Down
31 changes: 31 additions & 0 deletions data/class/SC_CheckError.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -862,6 +862,37 @@ public function GRAPH_CHECK($value)
}
}

/**
* パスワードに使用可能な文字列のチェック
*
* 半角英数字をそれぞれ1種類以上含む PASSWORD_MIN_LEN 文字以上 PASSWORD_MAX_LEN 文字以下の文字列ではない場合エラーとする
* PASSWORD_MIN_LEN が8未満の場合は E_USER_WARNING を出力する
*
* @param array $value $value[0] = 項目名 $value[1] = チェック対象のパスワード文字列
*/
public function PASSWORD_CHAR_CHECK($value)
{
if (PASSWORD_MIN_LEN < 8) {
trigger_error('PASSWORD_MIN_LEN が8未満に設定されています。', E_USER_WARNING);
}
$disp_name = $value[0];
$keyname = $value[1];

if (isset($this->arrErr[$keyname])) {
return;
}

$this->createParam($value);

$input_var = $this->arrParam[$keyname];
// see https://qiita.com/mpyw/items/886218e7b418dfed254b
$pattern = '/\A(?=.*?[a-z])(?=.*?\d)[!-~]{'.PASSWORD_MIN_LEN.','.PASSWORD_MAX_LEN.'}+\z/i';
if (strlen($input_var) > 0 && !preg_match($pattern, $input_var)) {
$this->arrErr[$keyname] =
"※ {$disp_name}は英数字をそれぞれ1種類使用し、".PASSWORD_MIN_LEN."文字以上で入力してください。<br />";
}
}

/*　必須選択の判定　*/
// 入力値で0が許されない場合エラーを返す
// value[0] = 項目名 value[1] = 判定対象
Expand Down
1 change: 1 addition & 0 deletions data/class/SC_FormParam.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,6 +206,7 @@ public function checkError($br = true)
case 'NUM_CHECK':
case 'EMAIL_CHECK':
case 'EMAIL_CHAR_CHECK':
case 'PASSWORD_CHAR_CHECK':
case 'ALNUM_CHECK':
case 'GRAPH_CHECK':
case 'KANA_CHECK':
Expand Down
4 changes: 2 additions & 2 deletions data/class/helper/SC_Helper_Customer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -430,7 +430,7 @@ public function sfCustomerCommonParam(&$objFormParam, $prefix = '')
*/
public function sfCustomerRegisterParam(&$objFormParam, $isAdmin = false, $is_mypage = false, $prefix = '')
{
$objFormParam->addParam('パスワード', $prefix . 'password', PASSWORD_MAX_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'GRAPH_CHECK'));
$objFormParam->addParam('パスワード', $prefix . 'password', PASSWORD_MAX_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'PASSWORD_CHAR_CHECK'));
$objFormParam->addParam('パスワード確認用の質問の答え', $prefix . 'reminder_answer', STEXT_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'MAX_LENGTH_CHECK'));
$objFormParam->addParam('パスワード確認用の質問', $prefix . 'reminder', STEXT_LEN, 'n', array('EXIST_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'));
$objFormParam->addParam('性別', $prefix . 'sex', INT_LEN, 'n', array('EXIST_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'));
Expand All @@ -443,7 +443,7 @@ public function sfCustomerRegisterParam(&$objFormParam, $isAdmin = false, $is_my

if (SC_Display_Ex::detectDevice() !== DEVICE_TYPE_MOBILE) {
$objFormParam->addParam('メールアドレス', $prefix . 'email', null, 'a', array('NO_SPTAB', 'EXIST_CHECK', 'EMAIL_CHECK', 'SPTAB_CHECK', 'EMAIL_CHAR_CHECK'));
$objFormParam->addParam('パスワード(確認)', $prefix . 'password02', PASSWORD_MAX_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'GRAPH_CHECK'), '', false);
$objFormParam->addParam('パスワード(確認)', $prefix . 'password02', PASSWORD_MAX_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'PASSWORD_CHAR_CHECK'), '', false);
if (!$isAdmin) {
$objFormParam->addParam('メールアドレス(確認)', $prefix . 'email02', null, 'a', array('NO_SPTAB', 'EXIST_CHECK', 'EMAIL_CHECK', 'SPTAB_CHECK', 'EMAIL_CHAR_CHECK'), '', false);
}
Expand Down
2 changes: 1 addition & 1 deletion data/class/pages/admin/LC_Page_Admin_Index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ public function action()
public function lfInitParam(&$objFormParam)
{
$objFormParam->addParam('ID', 'login_id', ID_MAX_LEN, '', array('EXIST_CHECK', 'ALNUM_CHECK' ,'MAX_LENGTH_CHECK'));
$objFormParam->addParam('PASSWORD', 'password', ID_MAX_LEN, '', array('EXIST_CHECK', 'GRAPH_CHECK', 'MAX_LENGTH_CHECK'));
$objFormParam->addParam('PASSWORD', 'password', PASSWORD_MAX_LEN, '', array('EXIST_CHECK', 'GRAPH_CHECK', 'MAX_LENGTH_CHECK'));
}

/**
Expand Down
8 changes: 4 additions & 4 deletions data/class/pages/admin/system/LC_Page_Admin_System_Input.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,8 +189,8 @@ public function initForm(&$objFormParam, &$arrParams, $mode = '')
$objFormParam->addParam('パスワード', 'password', '', '', array('EXIST_CHECK'));
$objFormParam->addParam('パスワード(確認)', 'password02', '', '', array('EXIST_CHECK'));
} else {
$objFormParam->addParam('パスワード', 'password', '', '', array('EXIST_CHECK', 'GRAPH_CHECK'));
$objFormParam->addParam('パスワード(確認)', 'password02', '', '', array('EXIST_CHECK', 'GRAPH_CHECK'));
$objFormParam->addParam('パスワード', 'password', '', '', array('EXIST_CHECK', 'PASSWORD_CHAR_CHECK'));
$objFormParam->addParam('パスワード(確認)', 'password02', '', '', array('EXIST_CHECK', 'PASSWORD_CHAR_CHECK'));
}
$objFormParam->addParam('権限', 'authority', INT_LEN, '', array('EXIST_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'));
$objFormParam->addParam('稼働/非稼働', 'work', INT_LEN, '', array('EXIST_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'));
Expand All @@ -216,10 +216,10 @@ public function validateData(&$objFormParam, &$arrParams, $mode)
// ログインID・パスワードの文字数チェック
$objErr = new SC_CheckError_Ex();
if ($mode == 'new') {
$objErr->doFunc(array('パスワード', 'password', ID_MIN_LEN, ID_MAX_LEN), array('NUM_RANGE_CHECK'));
$objErr->doFunc(array('パスワード', 'password', PASSWORD_MIN_LEN, PASSWORD_MAX_LEN), array('NUM_RANGE_CHECK'));
$objErr->doFunc(array('ログインID', 'login_id', ID_MIN_LEN, ID_MAX_LEN), array('NUM_RANGE_CHECK'));
} elseif ($mode == 'edit') {
$objErr->doFunc(array('パスワード', 'password', ID_MIN_LEN, ID_MAX_LEN), array('SPTAB_CHECK', 'NUM_RANGE_CHECK'));
$objErr->doFunc(array('パスワード', 'password', PASSWORD_MIN_LEN, PASSWORD_MAX_LEN), array('SPTAB_CHECK', 'NUM_RANGE_CHECK'));
$objErr->doFunc(array('ログインID', 'login_id', ID_MIN_LEN, ID_MAX_LEN), array('SPTAB_CHECK', 'NUM_RANGE_CHECK'));
}
$objErr->doFunc(array('パスワード', 'パスワード(確認)', 'password', 'password02'), array('EQUAL_CHECK'));
Expand Down
4 changes: 2 additions & 2 deletions data/mtb_constants_init.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,9 +255,9 @@
/** 電話番号総数 */
define('TEL_LEN', 12);
/** フロント画面用：パスワードの最小文字数 */
define('PASSWORD_MIN_LEN', 4);
define('PASSWORD_MIN_LEN', 8);
/** フロント画面用：パスワードの最大文字数 */
define('PASSWORD_MAX_LEN', STEXT_LEN);
define('PASSWORD_MAX_LEN', SMTEXT_LEN);
/** 検査数値用桁数(INT) */
define('INT_LEN', 9);
/** クレジットカードの文字数 (*モジュールで使用) */
Expand Down
6 changes: 3 additions & 3 deletions html/install/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -701,8 +701,8 @@ function lfInitWebParam($objWebParam)

$objWebParam->addParam('店名', 'shop_name', MTEXT_LEN, '', array('EXIST_CHECK', 'MAX_LENGTH_CHECK'), $shop_name);
$objWebParam->addParam('管理者：メールアドレス', 'admin_mail', null, '', array('EXIST_CHECK', 'EMAIL_CHECK', 'EMAIL_CHAR_CHECK'), $admin_mail);
$objWebParam->addParam('管理者：ログインID', 'login_id', ID_MAX_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'ALNUM_CHECK'));
$objWebParam->addParam('管理者：パスワード', 'login_pass', ID_MAX_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'ALNUM_CHECK'));
$objWebParam->addParam('管理者：ログインID', 'login_id', ID_MAX_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'GRAPH_CHECK'));
$objWebParam->addParam('管理者：パスワード', 'login_pass', PASSWORD_MAX_LEN, '', array('EXIST_CHECK', 'SPTAB_CHECK', 'PASSWORD_CHAR_CHECK'));
$objWebParam->addParam('管理機能：ディレクトリ', 'admin_dir', ID_MAX_LEN, 'a', array('EXIST_CHECK', 'SPTAB_CHECK', 'ALNUM_CHECK'), $oldAdminDir);
$objWebParam->addParam('管理機能：SSL制限', 'admin_force_ssl', 1, 'n', array('SPTAB_CHECK', 'NUM_CHECK', 'MAX_LENGTH_CHECK'), $admin_force_ssl);
$objWebParam->addParam('管理機能：IP制限', 'admin_allow_hosts', LTEXT_LEN, 'an', array('IP_CHECK', 'MAX_LENGTH_CHECK'), $admin_allow_hosts);
Expand Down Expand Up @@ -782,7 +782,7 @@ function lfCheckWebError($objWebParam)
$objErr->doFunc(array('管理者：ログインID', 'login_id', ID_MIN_LEN, ID_MAX_LEN), array('SPTAB_CHECK', 'NUM_RANGE_CHECK'));

// パスワードのチェック
$objErr->doFunc(array('管理者：パスワード', 'login_pass', ID_MIN_LEN, ID_MAX_LEN), array('SPTAB_CHECK', 'NUM_RANGE_CHECK'));
$objErr->doFunc(array('管理者：パスワード', 'login_pass', PASSWORD_MIN_LEN, PASSWORD_MAX_LEN), array('SPTAB_CHECK', 'NUM_RANGE_CHECK'));

// 管理機能ディレクトリのチェック
$objErr->doFunc(array('管理機能：ディレクトリ', 'admin_dir', ID_MIN_LEN, ID_MAX_LEN), array('SPTAB_CHECK', 'NUM_RANGE_CHECK'));
Expand Down
4 changes: 2 additions & 2 deletions html/install/sql/insert_data.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1170,8 +1170,8 @@ INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('ZIP01_LEN', '3', 20
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('ZIP02_LEN', '4', 201, '郵便番号2');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('TEL_ITEM_LEN', '6', 202, '電話番号各項目制限');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('TEL_LEN', '12', 203, '電話番号総数');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('PASSWORD_MIN_LEN', '4', 204, 'フロント画面用：パスワードの最小文字数');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('PASSWORD_MAX_LEN', 'STEXT_LEN', 205, 'フロント画面用：パスワードの最大文字数');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('PASSWORD_MIN_LEN', '8', 204, 'フロント画面用：パスワードの最小文字数');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('PASSWORD_MAX_LEN', 'SMTEXT_LEN', 205, 'フロント画面用：パスワードの最大文字数');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('INT_LEN', '9', 206, '検査数値用桁数(INT)');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('CREDIT_NO_LEN', '4', 207, 'クレジットカードの文字数 (*モジュールで使用)');
INSERT INTO mtb_constants (id, name, rank, remarks) VALUES ('SEARCH_CATEGORY_LEN', '18', 208, '検索カテゴリ最大表示文字数(byte)');
Expand Down
4 changes: 2 additions & 2 deletions html/install/templates/step1.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ $(function() {
</td>
</tr>
<tr>
<th>ログインID<span class="attention">※</span><br/>半角英数字<!--{$smarty.const.ID_MIN_LEN}-->～<!--{$smarty.const.ID_MAX_LEN}-->文字</th>
<th>ログインID<span class="attention">※</span><br/>半角英数字記号<!--{$smarty.const.ID_MIN_LEN}-->～<!--{$smarty.const.ID_MAX_LEN}-->文字</th>
<td>
<!--{assign var=key value="login_id"}-->
<span class="attention"><!--{$arrErr[$key]}--></span>
Expand All @@ -84,7 +84,7 @@ $(function() {
</td>
</tr>
<tr>
<th>パスワード<span class="attention">※</span><br/>半角英数字<!--{$smarty.const.ID_MIN_LEN}-->～<!--{$smarty.const.ID_MAX_LEN}-->文字</th>
<th>パスワード<span class="attention">※</span><br/>半角英数字記号<!--{$smarty.const.PASSWORD_MIN_LEN}-->～<!--{$smarty.const.PASSWORD_MAX_LEN}-->文字</th>
<td>
<!--{assign var=key value="login_pass"}-->
<span class="attention"><!--{$arrErr[$key]}--></span>
Expand Down
94 changes: 94 additions & 0 deletions tests/class/SC_CheckError/SC_CheckError_PASSWORD_CHAR_CHECKTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,94 @@
<?php

class SC_CheckError_PASSWORD_CHAR_CHECKTest extends SC_CheckError_AbstractTestCase
{
/** @var Faker\Generator */
protected $faker;

protected function setUp()
{
parent::setUp();
$this->target_func = 'PASSWORD_CHAR_CHECK';
$this->faker = Faker\Factory::create('ja_JP');
}

public function testPASSWORD_CHAR_CHECK()
{
$this->arrForm = [self::FORM_NAME => 'aaaa1111'];
$this->expected = '';

$this->scenario();
$this->verify();
}

public function testPASSWORD_CHAR_CHECKWithSymbol()
{
$this->arrForm = [self::FORM_NAME => 'aaaa.1111'];
$this->expected = '';

$this->scenario();
$this->verify();
}

public function testPASSWORD_CHAR_CHECKWithEmpty()
{
$this->arrForm = [self::FORM_NAME => ''];
$this->expected = '';

$this->scenario();
$this->verify();
}

public function testPASSWORD_CHAR_CHECKWithNull()
{
$this->arrForm = [self::FORM_NAME => null];
$this->expected = '';

$this->scenario();
$this->verify();
}

public function testPASSWORD_CHAR_CHECKWithFaker()
{
$this->arrForm = [
self::FORM_NAME => $this->faker->password(8, 100).'1'
];
$this->expected = '';
$this->scenario();
$this->verify($this->arrForm[self::FORM_NAME].' はパスワードに使用できない文字列です');
}

public function testPASSWORD_CHAR_CHECKWithAlphabetOnly()
{
$this->arrForm = [
self::FORM_NAME => 'password'
];
$this->expected = '※ PASSWORD_CHAR_CHECKは英数字をそれぞれ1種類使用し、8文字以上で入力してください。<br />';

$this->scenario();
$this->verify();
}

public function testPASSWORD_CHAR_CHECKWithNumberOnly()
{
$this->arrForm = [
self::FORM_NAME => '12345678'
];
$this->expected = '※ PASSWORD_CHAR_CHECKは英数字をそれぞれ1種類使用し、8文字以上で入力してください。<br />';

$this->scenario();
$this->verify();
}

public function testPASSWORD_CHAR_CHECKWithMinute()
{
$this->arrForm = [
self::FORM_NAME => $this->faker->password(6, 7)
];
$this->expected = '※ PASSWORD_CHAR_CHECKは英数字をそれぞれ1種類使用し、8文字以上で入力してください。<br />';

$this->scenario();
$this->verify();
}
}

4 changes: 0 additions & 4 deletions tests/class/plugin/LoadClassFileChangeTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,6 @@ protected function setUp()
{
parent::setUp();
$this->createPlugin();
if (PHP_VERSION_ID < 70200) {
$objPlugin = SC_Helper_Plugin_Ex::getSingletonInstance();
$objPlugin->load();
}
}

protected function tearDown()
Expand Down