Package: z3c.password
z3c.passwordThis package provides an API and implementation of a password generation and
verification utility. A high-security implementation is provided that is
suitable for banks and other high-security institutions. The package also
offers a field and a property for those fields.CHANGES1.1.0 (2021-12-14)Add support for Python 3.8, 3.9 and 3.10.Drop support for Python 3.4.1.0.0 (2018-11-14)Add support for Python 3.6 and 3.7. Drop support for Python 3.5 and
below. Drop Python 2.6 support.Drop support forNonepasswords, since they are not supported in the
underlying APIs anymore.1.0.0a1 (2013-02-28)Add support for Python 3.3.Drop dependency onzope.app.testingandzope.app.authentication.Replace deprecatedzope.interface.implementsusage with equivalentzope.interface.implementerdecorator.Drop support for Python 2.4 and 2.5.0.11.1 (2012-09-19)TooSimilarPassword: do not roundmaxSimilarityup, because we
sometimes use 0.999 to avoid the same password set.
0.999 would be displayed as 100% (100% vs. 100%)0.11.0 (2012-08-09)Better error messages for invalid password exceptions (when you reject the
user’s password for being too short or too long, it’s only polite to tell
them what the minimum/maximum password length is).This introduces new translatable strings which haven’t been translated yet.0.10.1 (2011-03-28)Minor changes:Password field: added ignoreEmpty=False parameterpreviousPasswords: always set the property, not just appendsome caching of IPasswordOptionsUtility property usage0.10.0 (2010-03-24)Check for relevancy of the request when counting failed login attempts as
early as possible. This prevents account locked errors raised for things like
resources.0.9.0 (2010-02-18)Added Dutch translations (janwijbrand)0.8.0 (2009-01-29)Feature:failedAttemptCheck:increment failedAttempts on all/any request (this is the default)increment failedAttempts only on non-resource requestsincrement failedAttempts only on POST requestsFeature: more specific exceptions on new password verification.0.7.4 (2009-12-22)Fix:PrincipalMixIn.passwordSetOnhappens to beNonein case the
class is mixed in after the user was created, that caused a bug.0.7.3 (2009-12-08)Fix:disallowPasswordReusemust not checkNonepasswords.0.7.2 (2009-08-07)German translations0.7.1 (2009-07-02)Feature:passwordOptionsUtilityNameproperty on thePrincipalMixIn.
This allows to set different options for a set of users instead of storing
the direct values on the principal.0.7.0 (2009-06-22)Feature: Even harder password settings:minLowerLetterminUpperLetterminDigitsminSpecialsminOthersminUniqueCharactersminUniqueLetters: count and do not allow less then specified numberFeature:disallowPasswordReuse: do not allow to set a previously used password100% test coverage0.6.0 (2009-06-17)Features:PrincipalMixIngot some new properties:passwordExpired: to force the expiry of the passwordlockOutPeriod: to enable automatic lock and unlock on too many bad triesIPasswordOptionsUtilityto have global password options:changePasswordOnNextLogin: not implemented here, use
PrincipalMixIn.passwordExpiredlockOutPeriod: global counterpart of the PrincipalMixIn propertypasswordExpiresAfter: global counterpart of the PrincipalMixIn propertymaxFailedAttempts: global counterpart of the PrincipalMixIn propertyPassword checking goes like this (on the high level):raise AccountLocked if too many bad tries and account should be lockedraise PasswordExpired if expired AND password matchesraise TooManyLoginFailures if too many bad triesreturn whether password matchesMore details inprincipal.txtAdded Russian translationRefactor PrincipalMixIn now() into a separate method to facilitate
override and testingChanged the order the password is checked:check password against storedcheck maxFailedAttempts, raise TooManyLoginFailures if overif password is OK, check expirationDate, raise PasswordExpired if overreturn whether password matchesThis is because I need to be sure that PasswordExpired is raised only if the
passwordISvalid. Entering an invalid passwordMUST NOTraise
PasswordExpired, because I want to use PasswordExpired to allow the user
to change it’s password. This should not happen if the user did not enter a
valid password.0.5.0 (2008-10-21)Initial Release