From 6fd4a51d961fc08eef0a40649879be97a54ded6b Mon Sep 17 00:00:00 2001
From: DariusIII <dkrisan@gmail.com>
Date: Tue, 9 Jan 2018 13:33:22 +0100
Subject: [PATCH] Update isValidPassword and generatePassword functions to
 check for and generate stronger passwords

---
 Changelog                    |  1 +
 app/Models/User.php          | 62 ++++++++++++++++++++++++++++--------
 public/pages/profileedit.php |  2 +-
 public/pages/register.php    |  2 +-
 4 files changed, 52 insertions(+), 15 deletions(-)

diff --git a/Changelog b/Changelog
index 5c89a884f..1440f252b 100755
--- a/Changelog
+++ b/Changelog
@@ -1,4 +1,5 @@
 2018-01-09 DariusIII
+	* Chg: Update isValidPassword and generatePassword functions to check for and generate stronger passwords
 	* Chg: Add php7.2 to travis tests
 	* Chg: Start switching to php7.2, remove mcrypt extension requirement from composer.json
 	* Chg: Remove config/nntmux.php
diff --git a/app/Models/User.php b/app/Models/User.php
index 94bcfdbf7..a82766ece 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -182,7 +182,7 @@ class User extends Authenticatable
      * @param string $email
      * @return int
      */
-    public static function getCount($role = '', $username = '', $host = '', $email = '')
+    public static function getCount($role = '', $username = '', $host = '', $email = ''): int
     {
         $res = self::query()->where('email', '!=', 'sharing@nZEDb.com');
 
@@ -482,11 +482,8 @@ class User extends Authenticatable
     }
 
     /**
-     * Hash a password using crypt.
-     *
-     * @param string $password
-     *
-     * @return string|bool
+     * @param $password
+     * @return mixed
      */
     public static function hashPassword($password)
     {
@@ -598,11 +595,51 @@ class User extends Authenticatable
     }
 
     /**
-     * @return string
+     * Generate a stron password
+     *
+     *
+     * @param int $length
+     * @param bool $add_dashes
+     * @param string $available_sets
+     * @return bool|string
      */
-    public static function generatePassword(): string
+    public static function generatePassword($length = 15, $add_dashes = false, $available_sets = 'luds')
     {
-        return Str::random(8);
+        $sets = [];
+        if (strpos($available_sets, 'l') !== false) {
+            $sets[] = 'abcdefghjkmnpqrstuvwxyz';
+        }
+        if (strpos($available_sets, 'u') !== false) {
+            $sets[] = 'ABCDEFGHJKMNPQRSTUVWXYZ';
+        }
+        if (strpos($available_sets, 'd') !== false) {
+            $sets[] = '23456789';
+        }
+        if (strpos($available_sets, 's') !== false) {
+            $sets[] = '!@#$%&*?';
+        }
+        $all = '';
+        $password = '';
+        foreach ($sets as $set) {
+            $password .= $set[random_int(0, \count(str_split($set))-1)];
+            $all .= $set;
+        }
+        $all = str_split($all);
+        for ($i = 0; $i < $length - \count($sets); $i++) {
+            $password .= $all[random_int(0, \count($all) - 1)];
+        }
+        $password = str_shuffle($password);
+        if (! $add_dashes) {
+            return $password;
+        }
+        $dash_len = floor(sqrt($length));
+        $dash_str = '';
+        while (\strlen($password) > $dash_len) {
+            $dash_str .= substr($password, 0, $dash_len) . '-';
+            $password = substr($password, $dash_len);
+        }
+        $dash_str .= $password;
+        return $dash_str;
     }
 
     /**
@@ -667,13 +704,12 @@ class User extends Authenticatable
     }
 
     /**
-     * @param $password
-     *
+     * @param string $password
      * @return bool
      */
-    public static function isValidPassword(string $password): bool
+    public static function isValidPassword(string $password)
     {
-        return \strlen($password) > 5;
+        return \strlen($password) > 8 && preg_match("#[0-9]+#", $password) && preg_match("#[A-Z]+#", $password) && preg_match("#[a-z]+#", $password);
     }
 
     /**
diff --git a/public/pages/profileedit.php b/public/pages/profileedit.php
index 8afe8ec58..af3d145cf 100644
--- a/public/pages/profileedit.php
+++ b/public/pages/profileedit.php
@@ -45,7 +45,7 @@ switch ($action) {
         if ($_POST['password'] !== '' && $_POST['password'] !== $_POST['confirmpassword']) {
             $errorStr = 'Password Mismatch';
         } elseif ($_POST['password'] !== '' && ! User::isValidPassword($_POST['password'])) {
-            $errorStr = 'Your password must be longer than five characters.';
+            $errorStr = 'Your password must be longer than eight characters, have at least 1 number, at least 1 capital and at least one lowercase letter';
         } elseif (! empty($_POST['nzbgeturl']) && $nzbGet->verifyURL($_POST['nzbgeturl']) === false) {
             $errorStr = 'The NZBGet URL you entered is invalid!';
         } elseif (! User::isValidEmail($_POST['email'])) {
diff --git a/public/pages/register.php b/public/pages/register.php
index 4f132e429..6f5d96a2e 100644
--- a/public/pages/register.php
+++ b/public/pages/register.php
@@ -71,7 +71,7 @@ if ($showRegister === 1) {
                                     $error = 'Your username must be at least five characters.';
                                     break;
                                 case User::ERR_SIGNUP_BADPASS:
-                                    $error = 'Your password must be longer than eight characters.';
+                                    $error = 'Your password must be longer than eight characters, have at least 1 number, at least 1 capital and at least one lowercase letter';
                                     break;
                                 case User::ERR_SIGNUP_BADEMAIL:
                                     $error = 'Your email is not a valid format.';