Repository: frappe/frappe

Issue:
Invalid Password HINT Message is Wrong
ErpNext & Frappe v13.28

1) On the "User" document, enter a short password like "test".
2) Click Save to save the User.
3) The following message appears:

![image](https://user-images.githubusercontent.com/64432562/180900127-71a03bc2-09f1-4b6a-9fe7-9f1203598ea5.png)

This incorrectly tells the user he needs symbol, number, or password. 

4) Change password to "thisisalongtest"
5) Click Save
6) It saves correctly.

Clearly the password policy does not require symbols, numbers, and capital letters so the HINT should not be telling you it does.

Suggested change:
Message could say "Your password is too short or not complex enough. Try increasing the length or adding special characters or both."


Discussion:

Resolving patch:
diff --git a/frappe/core/doctype/user/user.py b/frappe/core/doctype/user/user.py
--- a/frappe/core/doctype/user/user.py
+++ b/frappe/core/doctype/user/user.py
@@ -540,7 +540,7 @@ def password_strength_test(self):
 			feedback = result.get("feedback", None)
 
 			if feedback and not feedback.get("password_policy_validation_passed", False):
-				handle_password_test_fail(result)
+				handle_password_test_fail(feedback)
 
 	def suggest_username(self):
 		def _check_suggestion(suggestion):
@@ -686,7 +686,7 @@ def update_password(new_password, logout_all_sessions=0, key=None, old_password=
 	feedback = result.get("feedback", None)
 
 	if feedback and not feedback.get("password_policy_validation_passed", False):
-		handle_password_test_fail(result)
+		handle_password_test_fail(feedback)
 
 	res = _get_user_for_update_password(key, old_password)
 	if res.get("message"):
@@ -1042,13 +1042,15 @@ def notify_admin_access_to_system_manager(login_manager=None):
 		)
 
 
-def handle_password_test_fail(result):
-	suggestions = result["feedback"]["suggestions"][0] if result["feedback"]["suggestions"] else ""
-	warning = result["feedback"]["warning"] if "warning" in result["feedback"] else ""
-	suggestions += (
-		"<br>" + _("Hint: Include symbols, numbers and capital letters in the password") + "<br>"
-	)
-	frappe.throw(" ".join([_("Invalid Password:"), warning, suggestions]))
+def handle_password_test_fail(feedback: dict):
+	# Backward compatibility
+	if "feedback" in feedback:
+		feedback = feedback["feedback"]
+
+	suggestions = feedback.get("suggestions", [])
+	warning = feedback.get("warning", "")
+
+	frappe.throw(msg=" ".join([warning] + suggestions), title=_("Invalid Password"))
 
 
 def update_gravatar(name):


Test patch:
diff --git a/frappe/core/doctype/user/test_user.py b/frappe/core/doctype/user/test_user.py
--- a/frappe/core/doctype/user/test_user.py
+++ b/frappe/core/doctype/user/test_user.py
@@ -8,6 +8,7 @@
 import frappe
 import frappe.exceptions
 from frappe.core.doctype.user.user import (
+	handle_password_test_fail,
 	reset_password,
 	sign_up,
 	test_password_strength,
@@ -191,6 +192,12 @@ def test_password_strength(self):
 		# Score 1; should now fail
 		result = test_password_strength("bee2ve")
 		self.assertEqual(result["feedback"]["password_policy_validation_passed"], False)
+		self.assertRaises(
+			frappe.exceptions.ValidationError, handle_password_test_fail, result["feedback"]
+		)
+		self.assertRaises(
+			frappe.exceptions.ValidationError, handle_password_test_fail, result
+		)  # test backwards compatibility
 
 		# Score 4; should pass
 		result = test_password_strength("Eastern_43A1W")
@@ -200,7 +207,7 @@ def test_password_strength(self):
 		user = frappe.get_doc("User", "test@example.com")
 		frappe.flags.in_test = False
 		user.new_password = "password"
-		self.assertRaisesRegex(frappe.exceptions.ValidationError, "Invalid Password", user.save)
+		self.assertRaises(frappe.exceptions.ValidationError, user.save)
 		user.reload()
 		user.new_password = "Eastern_43A1W"
 		user.save()