passwords - 将正则表达式添加到 Sitecore 8 中的密码复杂性

Question

要求是要求用户使用复杂的密码，密码长度最少为 8 个字符。 1+ 个非字母数字字符。 1+ 个小写字母字符。 1+ 个大写字母字符。 1+ 个号码。

我可以通过将以下内容添加到 web.config 来完成此操作

<add name="sql" type="System.Web.Security.SqlMembershipProvider" connectionStringName="core" applicationName="sitecore" minRequiredPasswordLength="8" minRequiredNonalphanumericCharacters="1" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" passwordStrengthRegularExpression="(?=.{8,})(?=.*[\d])(?=.*[a-z])(?=.*[A-Z]).*" />

passwordStrengthRegularExpression 验证似乎不由 Sitecore 处理，因为当我输入无效密码时出现以下未处理的异常:

 376 15:59:41 ERROR Application error.
Exception: System.Web.HttpUnhandledException
Message: Exception of type 'System.Web.HttpUnhandledException' was thrown.
Source: System.Web
   at System.Web.UI.Page.HandleError(Exception e)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Nested Exception

Exception: System.Reflection.TargetInvocationException
Message: Exception has been thrown by the target of an invocation.
Source: mscorlib
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Sitecore.Web.UI.XamlSharp.Xaml.XamlControl.ExecuteAjaxMethod(AjaxMethodEventArgs e)
   at Sitecore.Web.UI.WebControls.AjaxScriptManager.DispatchMethod(Control control, String parameters)
   at Sitecore.Nexus.Pipelines.NexusPipelineApi.Resume(PipelineArgs args, Pipeline pipeline)
   at Sitecore.Pipelines.Pipeline.Start(PipelineArgs args, Boolean atomic)
   at Sitecore.Web.UI.WebControls.ContinuationManager.RunPipelines()
   at Sitecore.Web.UI.WebControls.ContinuationManager.OnPreRender(EventArgs e)
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Control.PreRenderRecursiveInternal()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Nested Exception

Exception: System.ArgumentException
Message: The parameter 'newPassword' does not match the regular expression specified in config file.
Source: System.Web
   at System.Web.Security.SqlMembershipProvider.ChangePassword(String username, String oldPassword, String newPassword)
   at Sitecore.Data.DataProviders.NullRetryer.Execute[T](Func`1 action, Action recover)
   at Sitecore.Security.SitecoreMembershipProvider.ChangePassword(String username, String oldPassword, String newPassword)
   at Sitecore.Security.Accounts.MembershipUserWrapper.ChangePassword(String oldPassword, String newPassword)
   at Sitecore.Shell.Applications.Security.SetPassword.SetPasswordPage.OK_Click() 

这可以通过修改配置值来实现，还是可以通过修补 <loggingin> 轻松实现？管道？

Answer 1

查看 SitecoreMembershipProvider 的代码，PasswordStrengthRegularExpession 有一个包装器属性， Material 方法只是将处理交给底层提供者，在本例中为 SqlMembershipProvider。所以错误实际上是在那里产生的，正如您从堆栈跟踪中看到的那样。

根据 MSDN documentation，该异常实际上是此方法的预期行为.在应用程序的登录/更改密码/新用户表单中，您应该根据 Membership.PasswordStrengthRegularExpression 手动验证用户输入，以确保在将新值传回 Sitecore 之前满足复杂性要求。

很难从您的问题中判断出来，但这是否涵盖您的情况，或者您指的是在 Sitecore 更改密码对话框中生成的错误(还没有尝试过)？如果是这种情况，我会提出支持票，因为系统确实应该优雅地应对这种情况。尽管 Nikola (@nsgocev) 回避了文档，但似乎至少 Sitecore 包装器的作者至少为此属性实现了基本的包装器。