Repository: Cloud-CV/EvalAI
Issue: Issue due to spaces in password while signing up
Root cause: Validation Gap

While signing up (new user) for EvalAI, I was required to set up a password for my account. The problem here is whether to allow spaces in password or not. While the frontend javascript checks donot check the presence or absence of spaces therefore a password like "abc abc " is accepted, but upon submitting, it shows that password is shorter than 8 characters, because of trimming of spaces at backend. This seems like an ambiguous message for the user.
ISSUE 2: Create a password of 8 spaces i.e. "        " and try setting it as password, there will again be an ambiguity with the error message shown.
ISSUE 3: There is a lower limit check on size of password, and no upper limit check on size of password, which may cause password overflow error, if user tries to enter a very long password to compromise with the system.
I can fix these both issues to display appropiate message to user, if this issue is accepted by the community.

@crypton3535 Agreed. Assigning this to you. Go ahead

@Obtin Sure. Assigning it to you.

Hey, since there has been no update on this issue, I was hoping I could be assigned this issue instead. However, I am new to this project and will be requiring some assistance in fixing this.

@party98 Sure! But please only work on one issue at a time and if you face any difficulty, ask us here or on the channel. 

Turns out issue1 and part of issue2 were due to password trimming in the authorisation module in Django. I have created a PR in the relevant repo to fix the same. 
As for issue3, the max password length allowed by Django is 4096 characters and that allowed by rest_auth is 128 characters. But as a standard I have seen the password fields to have 32 characters at max therefore I have applied the same limit.
The rest of the issues required minor changes in the frontend angular. 

@deshraj @RishabhJain2018  Can first part of issue be resolved by not allowing the user to enter a password with spaces? And in the third part what should be the maximum length?


Hey, there’s already a PR that has been submitted for the issue which identifies and fixes the issue not being the in the application code itself but in the library that handles logins. 

Sent from my iPhone

> On 21-Nov-2018, at 12:19 AM, Gautam Jajoo <notifications@github.com> wrote:
> 
> @deshraj @RishabhJain2018 Can first part of issue be resolved by not allowing the user to enter a password with spaces? And in the third part what should be the maximum length?
> 
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub, or mute the thread.


@party98 Since the password is bring trimmed at the backend for the time being we can disable the addition of spaces in the password??

Sorry for the delayed response guys.

> @deshraj @RishabhJain2018 Can first part of issue be resolved by not allowing the user to enter a password with spaces?

We should let the user type with spaces on the frontend but add a check where we check if the length of the password without spaces is >= 8.

> ISSUE 3: There is a lower limit check on size of password, and no upper limit check on size of password, which may cause password overflow error, if user tries to enter a very long password to compromise with the system.

I dont think we should put the check on the max limit of the field. I would let django allauth handle this part for us. :) 


@deshraj @gautamjajoo as for no allowing spaces, it was a bug in the Django allauth app, for which I have already submitted a PR #1778. The fix successfully allows the password to be set with or without spaces without trimming the spaces.

As for the upper limit, there needs to be a check on the frontend for checking the max length of the password as supported by the Django allauth app otherwise the api errors out. Glad to say, this issue is also fixed in PR #1778 

is it open or @parth-verma solution is to be merged?

Closing this since we don't want to handle the authorization and let django-allauth handle for us.