From raeburn at source.lon-capa.org  Mon Aug 19 12:37:21 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Mon, 19 Aug 2019 16:37:21 -0000
Subject: [LON-CAPA-cvs] cvs: doc(version_2_11_X) /loncapafiles
	loncapafiles.lpml
Message-ID: <cvsraeburn1566232641@cvsserver>

raeburn		Mon Aug 19 16:37:21 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /doc/loncapafiles	loncapafiles.lpml 
  Log:
  - For 2.11
    Backport 1.982
  
  
Index: doc/loncapafiles/loncapafiles.lpml
diff -u doc/loncapafiles/loncapafiles.lpml:1.797.2.105 doc/loncapafiles/loncapafiles.lpml:1.797.2.106
--- doc/loncapafiles/loncapafiles.lpml:1.797.2.105	Sun Aug 11 16:00:28 2019
+++ doc/loncapafiles/loncapafiles.lpml	Mon Aug 19 16:37:20 2019
@@ -2,7 +2,7 @@
  "http://lpml.sourceforge.net/DTD/lpml.dtd">
 <!-- loncapafiles.lpml -->
 
-<!-- $Id: loncapafiles.lpml,v 1.797.2.105 2019/08/11 16:00:28 raeburn Exp $ -->
+<!-- $Id: loncapafiles.lpml,v 1.797.2.106 2019/08/19 16:37:20 raeburn Exp $ -->
 
 <!--
 
@@ -4514,6 +4514,14 @@
 </filenames>
 </fileglob>
 <file>
+<source>loncom/localize/transliterate.pm</source>
+<target dist='default'>home/httpd/lib/perl/LONCAPA/transliterate.pm</target>
+<categoryname>handler</categoryname>
+<description>
+Transliteration of non-ascii to ascii characters in filenames.
+</description>
+</file>
+<file>
 <source>loncom/interface/loncoursedata.pm</source>
 <target dist='default'>home/httpd/lib/perl/Apache/loncoursedata.pm</target>
 <categoryname>handler</categoryname>



From raeburn at source.lon-capa.org  Mon Aug 19 13:27:50 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Mon, 19 Aug 2019 17:27:50 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /lonnet/perl lonnet.pm
Message-ID: <cvsraeburn1566235670@cvsserver>

raeburn		Mon Aug 19 17:27:50 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/lonnet/perl	lonnet.pm 
  Log:
  - For 2.11
    Backport 1.1406
  
  
Index: loncom/lonnet/perl/lonnet.pm
diff -u loncom/lonnet/perl/lonnet.pm:1.1172.2.109 loncom/lonnet/perl/lonnet.pm:1.1172.2.110
--- loncom/lonnet/perl/lonnet.pm:1.1172.2.109	Sat Aug 17 17:42:08 2019
+++ loncom/lonnet/perl/lonnet.pm	Mon Aug 19 17:27:49 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # TCP networking package
 #
-# $Id: lonnet.pm,v 1.1172.2.109 2019/08/17 17:42:08 raeburn Exp $
+# $Id: lonnet.pm,v 1.1172.2.110 2019/08/19 17:27:49 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -99,6 +99,7 @@
 use LONCAPA::Configuration;
 use LONCAPA::lonmetadata;
 use LONCAPA::Lond;
+use LONCAPA::transliterate;
 
 use File::Copy;
 
@@ -3566,6 +3567,9 @@
     }
 # Replace spaces by underscores
     $fname=~s/\s+/\_/g;
+# Transliterate non-ascii text to ascii
+    my $lang = &Apache::lonlocal::current_language();
+    $fname = &LONCAPA::transliterate::fname_to_ascii($fname,$lang);
 # Replace all other weird characters by nothing
     $fname=~s{[^/\w\.\-]}{}g;
 # Replace all .\d. sequences with _\d. so they no longer look like version
@@ -3573,6 +3577,7 @@
     $fname=~s/\.(\d+)(?=\.)/_$1/g;
     return $fname;
 }
+
 # This Function checks if an Image's dimensions exceed either $resizewidth (width) 
 # or $resizeheight (height) - both pixels. If so, the image is scaled to produce an 
 # image with the same aspect ratio as the original, but with dimensions which do 
@@ -3647,6 +3652,14 @@
     $fname=&clean_filename($fname);
     # See if there is anything left
     unless ($fname) { return 'error: no uploaded file'; }
+    # If filename now begins with a . prepend unix timestamp _ milliseconds
+    if ($fname =~ /^\./) {
+        my ($s,$usec) = &gettimeofday();
+        while (length($usec) < 6) {
+            $usec = '0'.$usec;
+        }
+        $fname = $s.'_'.substr($usec,0,3).$fname;
+    }
     # Files uploaded to help request form, or uploaded to "create course" page are handled differently
     if ((($formname eq 'screenshot') && ($subdir eq 'helprequests')) ||
         (($formname eq 'coursecreatorxml') && ($subdir eq 'batchupload')) ||



From raeburn at source.lon-capa.org  Mon Aug 19 13:35:35 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Mon, 19 Aug 2019 17:35:35 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /lonnet/perl lonnet.pm
Message-ID: <cvsraeburn1566236135@cvsserver>

raeburn		Mon Aug 19 17:35:35 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/lonnet/perl	lonnet.pm 
  Log:
  - For 2.11
    Backport 1.1396
  
  
Index: loncom/lonnet/perl/lonnet.pm
diff -u loncom/lonnet/perl/lonnet.pm:1.1172.2.110 loncom/lonnet/perl/lonnet.pm:1.1172.2.111
--- loncom/lonnet/perl/lonnet.pm:1.1172.2.110	Mon Aug 19 17:27:49 2019
+++ loncom/lonnet/perl/lonnet.pm	Mon Aug 19 17:35:34 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # TCP networking package
 #
-# $Id: lonnet.pm,v 1.1172.2.110 2019/08/19 17:27:49 raeburn Exp $
+# $Id: lonnet.pm,v 1.1172.2.111 2019/08/19 17:35:34 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -409,8 +409,26 @@
     unless (defined(&hostname($server))) { return 'no_such_host'; }
     my $answer=subreply($cmd,$server);
     if (($answer=~/^refused/) || ($answer=~/^rejected/)) {
-       &logthis("<font color=\"blue\">WARNING:".
-                " $cmd to $server returned $answer</font>");
+        my $logged = $cmd;
+        if ($cmd =~ /^encrypt:([^:]+):/) {
+            my $subcmd = $1;
+            if (($subcmd eq 'auth') || ($subcmd eq 'passwd') ||
+                ($subcmd eq 'changeuserauth') || ($subcmd eq 'makeuser') ||
+                ($subcmd eq 'putdom') || ($subcmd eq 'autoexportgrades')) {
+                (undef,undef,my @rest) = split(/:/,$cmd);
+                if (($subcmd eq 'auth') || ($subcmd eq 'putdom')) {
+                    splice(@rest,2,1,'Hidden');
+                } elsif ($subcmd eq 'passwd') {
+                    splice(@rest,2,2,('Hidden','Hidden'));
+                } elsif (($subcmd eq 'changeuserauth') || ($subcmd eq 'makeuser') ||
+                         ($subcmd eq 'autoexportgrades')) {
+                    splice(@rest,3,1,'Hidden');
+                }
+                $logged = join(':',('encrypt:'.$subcmd, at rest));
+            }
+        }
+        &logthis("<font color=\"blue\">WARNING:".
+                 " $logged to $server returned $answer</font>");
     }
     return $answer;
 }



From raeburn at source.lon-capa.org  Mon Aug 19 13:57:05 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Mon, 19 Aug 2019 17:57:05 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /homework lonmaxima.pm
	/lonnet/perl lonnet.pm
Message-ID: <cvsraeburn1566237425@cvsserver>

raeburn		Mon Aug 19 17:57:05 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/homework	lonmaxima.pm 
    /loncom/lonnet/perl	lonnet.pm 
  Log:
  - For 2.11
    Backport 1.1390
  
  
Index: loncom/homework/lonmaxima.pm
diff -u loncom/homework/lonmaxima.pm:1.35 loncom/homework/lonmaxima.pm:1.36
--- loncom/homework/lonmaxima.pm:1.35	Tue Mar  7 01:56:56 2017
+++ loncom/homework/lonmaxima.pm	Tue Mar  7 16:04:35 2017
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Interface routines to MAXIMA CAS
 #
-# $Id: lonmaxima.pm,v 1.35 2017/03/07 01:56:56 raeburn Exp $
+# $Id: lonmaxima.pm,v 1.36 2017/03/07 16:04:35 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -155,6 +155,9 @@
 
 sub compareterms {
     my ($socket,$terma,$termb)=@_;
+    if ($terma =~ m{\(\s*\([^)]*$}) {
+        return 'Error: blacklisted';
+    }
     my $difference='('.$terma.')-('.$termb.')';
     if (&blacklisted($difference)) { return 'Error: blacklisted'; }
     my $reply=&maximareply($socket,'trigsimp(trigreduce('.$difference.'));');
Index: loncom/lonnet/perl/lonnet.pm
diff -u loncom/lonnet/perl/lonnet.pm:1.1172.2.111 loncom/lonnet/perl/lonnet.pm:1.1172.2.112
--- loncom/lonnet/perl/lonnet.pm:1.1172.2.111	Mon Aug 19 17:35:34 2019
+++ loncom/lonnet/perl/lonnet.pm	Mon Aug 19 17:57:03 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # TCP networking package
 #
-# $Id: lonnet.pm,v 1.1172.2.111 2019/08/19 17:35:34 raeburn Exp $
+# $Id: lonnet.pm,v 1.1172.2.112 2019/08/19 17:57:03 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -897,6 +897,7 @@
 	while ($filename=readdir(LONIDS)) {
 	    next if ($filename eq '.' || $filename eq '..');
 	    next if ($filename =~ /publicuser_\d+\.id/);
+            next if ($filename =~ /^[a-f0-9]+_linked\.id$/);
 	    my ($mtime)=(stat($perlvar{'lonIDsDir'}.'/'.$filename))[9];
 	    if ($curtime-$mtime < 1800) { $numusers++; }
 	}



From raeburn at source.lon-capa.org  Mon Aug 19 23:46:10 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Tue, 20 Aug 2019 03:46:10 -0000
Subject: [LON-CAPA-cvs] cvs: loncom /lonnet/perl lonnet.pm
Message-ID: <cvsraeburn1566272770@cvsserver>

raeburn		Tue Aug 20 03:46:10 2019 EDT

  Modified files:              
    /loncom/lonnet/perl	lonnet.pm 
  Log:
  - Call &EXT('client.remote_addr'} to retrieve user's IP address.
  
  
Index: loncom/lonnet/perl/lonnet.pm
diff -u loncom/lonnet/perl/lonnet.pm:1.1414 loncom/lonnet/perl/lonnet.pm:1.1415
--- loncom/lonnet/perl/lonnet.pm:1.1414	Thu Jul 25 20:23:59 2019
+++ loncom/lonnet/perl/lonnet.pm	Tue Aug 20 03:46:09 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # TCP networking package
 #
-# $Id: lonnet.pm,v 1.1414 2019/07/25 20:23:59 raeburn Exp $
+# $Id: lonnet.pm,v 1.1415 2019/08/20 03:46:09 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -12280,6 +12280,10 @@
 	if ($space eq 'name') {
 	    return $ENV{'SERVER_NAME'};
         }
+    } elsif ($realm eq 'client') {
+        if ($space eq 'remote_addr') {
+            return $ENV{'REMOTE_ADDR'};
+        }
     }
     return '';
 }



From raeburn at source.lon-capa.org  Wed Aug 21 16:31:40 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Wed, 21 Aug 2019 20:31:40 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface domainprefs.pm
Message-ID: <cvsraeburn1566419500@cvsserver>

raeburn		Wed Aug 21 20:31:40 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	domainprefs.pm 
  Log:
  - For 2.11
    Backport 1.354, 1.355, 1.356, 1.358, 1.359, 1.361 
    (except password expiration parts).
  
  
-------------- next part --------------
Index: loncom/interface/domainprefs.pm
diff -u loncom/interface/domainprefs.pm:1.160.6.97 loncom/interface/domainprefs.pm:1.160.6.98
--- loncom/interface/domainprefs.pm:1.160.6.97	Sat Aug 17 19:24:29 2019
+++ loncom/interface/domainprefs.pm	Wed Aug 21 20:31:37 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.160.6.97 2019/08/17 19:24:29 raeburn Exp $
+# $Id: domainprefs.pm,v 1.160.6.98 2019/08/21 20:31:37 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -216,8 +216,8 @@
                 'contacts','defaults','scantron','coursecategories',
                 'serverstatuses','requestcourses','helpsettings',
                 'coursedefaults','usersessions','loadbalancing',
-                'requestauthor','selfenrollment','inststatus'],$dom);
-    my @prefs_order = ('rolecolors','login','defaults','quotas','autoenroll',
+                'requestauthor','selfenrollment','inststatus','passwords'],$dom);
+    my @prefs_order = ('rolecolors','login','defaults','passwords','quotas','autoenroll',
                        'autoupdate','autocreate','directorysrch','contacts',
                        'usercreation','selfcreation','usermodification','scantron',
                        'requestcourses','requestauthor','coursecategories',
@@ -262,13 +262,25 @@
                       help => 'Domain_Configuration_LangTZAuth',
                       header => [{col1 => 'Setting',
                                   col2 => 'Value'},
-                                 {col1 => 'Internal Authentication',
-                                  col2 => 'Value'},
                                  {col1 => 'Institutional user types',
                                   col2 => 'Name displayed'}],
                       print => \&print_defaults,
                       modify => \&modify_defaults,
                     },
+        'passwords' =>
+                    { text => 'Passwords (Internal authentication)',
+                      help => 'Domain_Configuration_Passwords',
+                      header => [{col1 => 'Resetting Forgotten Password',
+                                  col2 => 'Settings'},
+                                 {col1 => 'Encryption of Stored Passwords (Internal Auth)',
+                                  col2 => 'Settings'},
+                                 {col1 => 'Rules for LON-CAPA Passwords',
+                                  col2 => 'Settings'},
+                                 {col1 => 'Course Owner Changing Student Passwords',
+                                  col2 => 'Settings'}],
+                      print => \&print_passwords,
+                      modify => \&modify_passwords,
+                    },
         'quotas' => 
                     { text => 'Blogs, personal web pages, webDAV/quotas, portfolios',
                       help => 'Domain_Configuration_Quotas',
@@ -658,6 +670,8 @@
         $output = &modify_usersessions($dom,$lastactref,%domconfig);
     } elsif ($action eq 'loadbalancing') {
         $output = &modify_loadbalancing($dom,%domconfig);
+    } elsif ($action eq 'passwords') {
+        $output = &modify_passwords($r,$dom,$confname,$lastactref,%domconfig);
     }
     return $output;
 }
@@ -670,6 +684,8 @@
         $output = &coursecategories_javascript($settings);
     } elsif ($action eq 'defaults') {
         $output = &defaults_javascript($settings); 
+    } elsif ($action eq 'passwords') {
+        $output = &passwords_javascript();
     } elsif ($action eq 'helpsettings') {
         my (%privs,%levelscurrent);
         my %full=();
@@ -724,6 +740,8 @@
             ($action eq 'selfenrollment') || ($action eq 'usersessions') || ($action eq 'directorysrch') ||
             ($action eq 'helpsettings') || ($action eq 'contacts')) {
             $output .= $item->{'print'}->('top',$dom,$settings,\$rowtotal);
+        } elsif ($action eq 'passwords') {
+            $output .= $item->{'print'}->('top',$dom,$confname,$settings,\$rowtotal);
         } elsif ($action eq 'coursecategories') {
             $output .= $item->{'print'}->('top',$dom,$item,$settings,\$rowtotal);
         } elsif ($action eq 'scantron') {
@@ -755,10 +773,12 @@
         if (($action eq 'autoupdate') || ($action eq 'usercreation') ||
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') ||
-            ($action eq 'contacts') || ($action eq 'defaults')) {
+            ($action eq 'contacts') || ($action eq 'passwords')) {
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
+            } elsif ($action eq 'passwords') {
+                $output .= $item->{'print'}->('middle',$dom,$confname,$settings,\$rowtotal);
             } else {
                 $output .= $item->{'print'}->('middle',$dom,$settings,\$rowtotal);
             }
@@ -775,6 +795,23 @@
              </tr>'."\n";
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('bottom',$dom,$item,$settings,\$rowtotal);
+            } elsif ($action eq 'passwords') {
+                $output .= $item->{'print'}->('lower',$dom,$confname,$settings,\$rowtotal).'
+             </tr>
+            </table>
+           </td>
+          </tr>
+          <tr>
+           <td>
+            <table class="LC_nested">
+             <tr class="LC_info_row">
+              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
+              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td></tr>'."\n".
+              $item->{'print'}->('bottom',$dom,$confname,$settings,\$rowtotal).'
+            </table>
+          </td>
+         </tr>
+         <tr>';
             } else {
                 $output .= $item->{'print'}->('bottom',$dom,$settings,\$rowtotal);
             }
@@ -4017,6 +4054,427 @@
     return $datatable;
 }
 
+sub print_passwords {
+    my ($position,$dom,$confname,$settings,$rowtotal) = @_;
+    my ($datatable,$css_class);
+    my $itemcount = 0;
+    my %titles = &Apache::lonlocal::texthash (
+        captcha        => '"Forgot Password" CAPTCHA validation',
+        link           => 'Reset link expiration (hours)',
+        case           => 'Case-sensitive usernames/e-mail',
+        prelink        => 'Information required (form 1)',
+        postlink       => 'Information required (form 2)',
+        emailsrc       => 'LON-CAPA e-mail address type(s)',
+        customtext     => 'Domain specific text (HTML)',
+        intauth_cost   => 'Encryption cost for bcrypt (positive integer)',
+        intauth_check  => 'Check bcrypt cost if authenticated',
+        intauth_switch => 'Existing crypt-based switched to bcrypt on authentication',
+        permanent      => 'Permanent e-mail address',
+        critical       => 'Critical notification address',
+        notify         => 'Notification address',
+        min            => 'Minimum password length',
+        max            => 'Maximum password length',
+        chars          => 'Required characters',
+        numsaved       => 'Number of previous passwords to save and disallow reuse',
+    );
+    if ($position eq 'top') {
+        my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
+        my $shownlinklife = 2;
+        my $prelink = 'both';
+        my (%casesens,%postlink,%emailsrc,$nostdtext,$customurl);
+        if (ref($settings) eq 'HASH') {
+            if ($settings->{resetlink} =~ /^\d+(|\.\d*)$/) {
+                $shownlinklife = $settings->{resetlink};
+            }
+            if (ref($settings->{resetcase}) eq 'ARRAY') {
+                map { $casesens{$_} = 1; } (@{$settings->{resetcase}});
+            }
+            if ($settings->{resetprelink} =~ /^(both|either)$/) {
+                $prelink = $settings->{resetprelink};
+            }
+            if (ref($settings->{resetpostlink}) eq 'HASH') {
+                %postlink = %{$settings->{resetpostlink}};
+            }
+            if (ref($settings->{resetemail}) eq 'ARRAY') {
+                map { $emailsrc{$_} = 1; } (@{$settings->{resetemail}});
+            }
+            if ($settings->{resetremove}) {
+                $nostdtext = 1;
+            }
+            if ($settings->{resetcustom}) {
+                $customurl = $settings->{resetcustom};
+            }
+        } else {
+            if (ref($types) eq 'ARRAY') {
+                foreach my $item (@{$types}) {
+                    $casesens{$item} = 1;
+                    $postlink{$item} = ['username','email'];
+                }
+                }
+            }
+            $casesens{'default'} = 1;
+            $postlink{'default'} = ['username','email'];
+            $prelink = 'both';
+            %emailsrc = (
+                          permanent => 1,
+                          critical  => 1,
+                          notify    => 1,
+            );
+        }
+        $datatable = &captcha_choice('passwords',$settings,$$rowtotal);
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'link'}.'</td>'.
+                      '<td class="LC_left_item">'.
+                      '<input type="textbox" value="'.$shownlinklife.'" '.
+                      'name="passwords_link" size="3" /></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'case'}.'</td>'.
+                      '<td class="LC_left_item">';
+        if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+            foreach my $item (@{$types}) {
+                my $checkedcase;
+                if ($casesens{$item}) {
+                    $checkedcase = ' checked="checked"';
+                }
+                $datatable .= '<span class="LC_nobreak"><label>'.
+                              '<input type="checkbox" name="passwords_case_sensitive" value="'.
+                              $item.'"'.$checkedcase.' />'.$usertypes->{$item}.'</label>'.
+                              '<span>&nbsp;&nbsp; ';
+            }
+        }
+        my $checkedcase;
+        if ($casesens{'default'}) {
+            $checkedcase = ' checked="checked"';
+        }
+        $datatable .= '<span class="LC_nobreak"><label><input type="checkbox" '.
+                      'name="passwords_case_sensitive" value="default"'.$checkedcase.' />'.
+                      $othertitle.'</label></span></td>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        my %checkedpre = (
+                             both => ' checked="checked"',
+                             either => '',
+                         );
+        if ($prelink eq 'either') {
+            $checkedpre{either} = ' checked="checked"';
+            $checkedpre{both} = '';
+        }
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'prelink'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<label><input type="radio" name="passwords_prelink" value="both"'.$checkedpre{'both'}.' />'.
+                      &mt('Both username and e-mail address').'</label></span>&nbsp;&nbsp; '.
+                      '<span class="LC_nobreak"><label>'.
+                      '<input type="radio" name="passwords_prelink" value="either"'.$checkedpre{'either'}.' />'.
+                      &mt('Either username or e-mail address').'</label></span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'postlink'}.'</td>'.
+                      '<td class="LC_left_item">';
+        my %postlinked;
+        if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+            foreach my $item (@{$types}) {
+                undef(%postlinked);
+                $datatable .= '<fieldset style="display: inline-block;">'.
+                              '<legend>'.$usertypes->{$item}.'</legend>';
+                if (ref($postlink{$item}) eq 'ARRAY') {
+                    map { $postlinked{$_} = 1; } (@{$postlink{$item}});
+                }
+                foreach my $field ('email','username') {
+                    my $checked;
+                    if ($postlinked{$field}) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<span class="LC_nobreak"><label>'.
+                                  '<input type="checkbox" name="passwords_postlink_'.$item.'" value="'.
+                                  $field.'"'.$checked.' />'.$field.'</label>'.
+                                  '<span>&nbsp;&nbsp; ';
+                }
+                $datatable .= '</fieldset>';
+            }
+        }
+        if (ref($postlink{'default'}) eq 'ARRAY') {
+            map { $postlinked{$_} = 1; } (@{$postlink{'default'}});
+        }
+        $datatable .= '<fieldset style="display: inline-block;">'.
+                      '<legend>'.$othertitle.'</legend>';
+        foreach my $field ('email','username') {
+            my $checked;
+            if ($postlinked{$field}) {
+                $checked = ' checked="checked"';
+            }
+            $datatable .= '<span class="LC_nobreak"><label>'.
+                          '<input type="checkbox" name="passwords_postlink_default" value="'.
+                          $field.'"'.$checked.' />'.$field.'</label>'.
+                          '<span>&nbsp;&nbsp; ';
+        }
+        $datatable .= '</fieldset></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'emailsrc'}.'</td>'.
+                      '<td class="LC_left_item">';
+        foreach my $type ('permanent','critical','notify') {
+            my $checkedemail;
+            if ($emailsrc{$type}) {
+                $checkedemail = ' checked="checked"';
+            }
+            $datatable .= '<span class="LC_nobreak"><label>'.
+                          '<input type="checkbox" name="passwords_emailsrc" value="'.
+                          $type.'"'.$checkedemail.' />'.$titles{$type}.'</label>'.
+                          '<span>&nbsp;&nbsp; ';
+        }
+        $datatable .= '</td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        my $switchserver = &check_switchserver($dom,$confname);
+        my ($showstd,$noshowstd);
+        if ($nostdtext) {
+            $noshowstd = ' checked="checked"';
+        } else {
+            $showstd = ' checked="checked"';
+        }
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'customtext'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      &mt('Retain standard text:').
+                      '<label><input type="radio" name="passwords_stdtext" value="1"'.$showstd.' />'.
+                      &mt('Yes').'</label>'.'&nbsp;'.
+                      '<label><input type="radio" name="passwords_stdtext" value="0"'.$noshowstd.' />'.
+                      &mt('No').'</label></span><br />'.
+                      '<span class="LC_fontsize_small">'.
+                      &mt('(If you use the same account ...  reset a password from this page.)').'</span><br /><br />'.
+                      &mt('Include custom text:');
+        if ($customurl) {
+            my $link =  &Apache::loncommon::modal_link($customurl,&mt('Custom text file'),600,500,
+                                                       undef,undef,undef,undef,'background-color:#ffffff');
+            $datatable .= '<span class="LC_nobreak">&nbsp;'.$link.
+                          '<label><input type="checkbox" name="passwords_custom_del"'.
+                          ' value="1" />'.&mt('Delete?').'</label></span>'.
+                          ' <span class="LC_nobreak">&nbsp;'.&mt('Replace:').'</span>';
+        }
+        if ($switchserver) {
+            $datatable .= '<span class="LC_nobreak">&nbsp;'.&mt('Upload to library server: [_1]',$switchserver).'</span>';
+        } else {
+            $datatable .='<span class="LC_nobreak">&nbsp;'.
+                         '<input type="file" name="passwords_customfile" /></span>';
+        }
+        $datatable .= '</td></tr>';
+    } elsif ($position eq 'middle') {
+        my %domconf = &Apache::lonnet::get_dom('configuration',['defaults'],$dom);
+        my @items = ('intauth_cost','intauth_check','intauth_switch');
+        my %defaults;
+        if (ref($domconf{'defaults'}) eq 'HASH') {
+            %defaults = %{$domconf{'defaults'}};
+            if ($defaults{'intauth_cost'} !~ /^\d+$/) {
+                $defaults{'intauth_cost'} = 10;
+            }
+            if ($defaults{'intauth_check'} !~ /^(0|1|2)$/) {
+                $defaults{'intauth_check'} = 0;
+            }
+            if ($defaults{'intauth_switch'} !~ /^(0|1|2)$/) {
+                $defaults{'intauth_switch'} = 0;
+            }
+        } else {
+            %defaults = (
+                          'intauth_cost'   => 10,
+                          'intauth_check'  => 0,
+                          'intauth_switch' => 0,
+                        );
+        }
+        foreach my $item (@items) {
+            if ($itemcount%2) {
+                $css_class = '';
+            } else {
+                $css_class = ' class="LC_odd_row" ';
+            }
+            $datatable .= '<tr'.$css_class.'>'.
+                          '<td><span class="LC_nobreak">'.$titles{$item}.
+                          '</span></td><td class="LC_left_item" colspan="3">';
+            if ($item eq 'intauth_switch') {
+                my @options = (0,1,2);
+                my %optiondesc = &Apache::lonlocal::texthash (
+                                   0 => 'No',
+                                   1 => 'Yes',
+                                   2 => 'Yes, and copy existing passwd file to passwd.bak file',
+                                 );
+                $datatable .= '<table width="100%">';
+                foreach my $option (@options) {
+                    my $checked = ' ';
+                    if ($defaults{$item} eq $option) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
+                                  '<label><input type="radio" name="'.$item.
+                                  '" value="'.$option.'"'.$checked.' />'.
+                                  $optiondesc{$option}.'</label></span></td></tr>';
+                }
+                $datatable .= '</table>';
+            } elsif ($item eq 'intauth_check') {
+                my @options = (0,1,2);
+                my %optiondesc = &Apache::lonlocal::texthash (
+                                   0 => 'No',
+                                   1 => 'Yes, allow login then update passwd file using default cost (if higher)',
+                                   2 => 'Yes, disallow login if stored cost is less than domain default',
+                                 );
+                $datatable .= '<table width="100%">';
+                foreach my $option (@options) {
+                    my $checked = ' ';
+                    my $onclick;
+                    if ($defaults{$item} eq $option) {
+                        $checked = ' checked="checked"';
+                    }
+                    if ($option == 2) {
+                        $onclick = ' onclick="javascript:warnIntAuth(this);"';
+                    }
+                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
+                                  '<label><input type="radio" name="'.$item.
+                                  '" value="'.$option.'"'.$checked.$onclick.' />'.
+                                  $optiondesc{$option}.'</label></span></td></tr>';
+                }
+                $datatable .= '</table>';
+            } else {
+                $datatable .= '<input type="text" name="'.$item.'" value="'.
+                              $defaults{$item}.'" size="3" onblur="javascript:warnIntAuth(this);" />';
+            }
+            $datatable .= '</td></tr>';
+            $itemcount ++;
+        }
+    } elsif ($position eq 'lower') {
+        my ($min,$max,%chars,$numsaved);
+        if (ref($settings) eq 'HASH') {
+            if ($settings->{min}) {
+                $min = $settings->{min};
+            }
+            if ($settings->{max}) {
+                $max = $settings->{max};
+            }
+            if (ref($settings->{chars}) eq 'ARRAY') {
+                map { $chars{$_} = 1; } (@{$settings->{chars}});
+            }
+            if ($settings->{numsaved}) {
+                $numsaved = $settings->{numsaved};
+            }
+        } else {
+            $min = '7';
+        }
+        my %rulenames = &Apache::lonlocal::texthash(
+                                                     uc => 'At least one upper case letter',
+                                                     lc => 'At least one lower case letter',
+                                                     num => 'At least one number',
+                                                     spec => 'At least one non-alphanumeric',
+                                                   );
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no minimum)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'chars'}.'<br />'.
+                      '<span class="LC_nobreak LC_fontsize_small">'.&mt('(Leave unchecked if not required)').
+                      '</span></td>';
+        my $numinrow = 2;
+        my @possrules = ('uc','lc','num','spec');
+        $datatable .= '<td class="LC_left_item"><table>';
+        for (my $i=0; $i<@possrules; $i++) {
+            my ($rem,$checked);
+            if ($chars{$possrules[$i]}) {
+                $checked = ' checked="checked"';
+            }
+            $rem = $i%($numinrow);
+            if ($rem == 0) {
+                if ($i > 0) {
+                    $datatable .= '</tr>';
+                }
+                $datatable .= '<tr>';
+            }
+            $datatable .= '<td><span class="LC_nobreak"><label>'.
+                          '<input type="checkbox" name="passwords_chars" value="'.$possrules[$i].'"'.$checked.' />'.
+                          $rulenames{$possrules[$i]}.'</label></span></td>';
+        }
+        my $rem = @possrules%($numinrow);
+        my $colsleft = $numinrow - $rem;
+        if ($colsleft > 1 ) {
+            $datatable .= '<td colspan="'.$colsleft.'" class="LC_left_item">'.
+                          '&nbsp;</td>';
+        } elsif ($colsleft == 1) {
+            $datatable .= '<td class="LC_left_item">&nbsp;</td>';
+        }
+        $datatable .='</table></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
+                      '</span></td></tr>';
+    } else {
+        my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
+        my %ownerchg = (
+                          by  => {},
+                          for => {},
+                       );
+        my %ownertitles = &Apache::lonlocal::texthash (
+                            by  => 'Course owner status(es) allowed',
+                            for => 'Student status(es) allowed',
+                          );
+        if (ref($settings) eq 'HASH') {
+            if (ref($settings->{crsownerchg}) eq 'HASH') {
+                if (ref($settings->{crsownerchg}{'by'}) eq 'ARRAY') {
+                    map { $ownerchg{by}{$_} = 1; } (@{$settings->{crsownerchg}{'by'}});
+                }
+                if (ref($settings->{crsownerchg}{'for'}) eq 'ARRAY') {
+                    map { $ownerchg{for}{$_} = 1; } (@{$settings->{crsownerchg}{'for'}});
+                }
+            }
+        }
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr '.$css_class.'>'.
+                      '<td>'.
+                      &mt('Requirements').'<ul>'.
+                      '<li>'.&mt("Course 'type' is not a Community").'</li>'.
+                      '<li>'.&mt('User is Course Coordinator and also course owner').'</li>'.
+                      '<li>'.&mt("Student's only active roles are student role(s) in course(s) owned by this user").'</li>'.
+                      '<li>'.&mt('User, course, and student share same domain').'</li>'.
+                      '</ul>'.
+                      '</td>'.
+                      '<td class="LC_left_item">';
+        foreach my $item ('by','for') {
+            $datatable .= '<fieldset style="display: inline-block;">'.
+                          '<legend>'.$ownertitles{$item}.'</legend>';
+            if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                foreach my $type (@{$types}) {
+                    my $checked;
+                    if ($ownerchg{$item}{$type}) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<span class="LC_nobreak"><label>'.
+                                  '<input type="checkbox" name="passwords_crsowner_'.$item.'" value="'.
+                                  $type.'"'.$checked.' />'.$usertypes->{$type}.'</label>'.
+                                  '<span>&nbsp;&nbsp; ';
+                }
+            }
+            my $checked;
+            if ($ownerchg{$item}{'default'}) {
+                $checked = ' checked="checked"';
+            }
+            $datatable .= '<span class="LC_nobreak"><label><input type="checkbox" '.
+                          'name="passwords_crsowner_'.$item.'" value="default"'.$checked.' />'.
+                          $othertitle.'</label></span></fieldset>';
+        }
+        $datatable .= '</td></tr>';
+    }
+    return $datatable;
+}
+
 sub print_usersessions {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my ($css_class,$datatable,%checked,%choices);
@@ -5575,10 +6033,14 @@
         $vertext,$currver); 
     my %lt = &captcha_phrases();
     $keyentry = 'hidden';
+    my $colspan=2;
     if ($context eq 'cancreate') {
         $rowname = &mt('CAPTCHA validation');
     } elsif ($context eq 'login') {
         $rowname =  &mt('"Contact helpdesk" CAPTCHA validation');
+    } elsif ($context eq 'passwords') {
+        $rowname = &mt('"Forgot Password" CAPTCHA validation');
+        $colspan=1;
     }
     if (ref($settings) eq 'HASH') {
         if ($settings->{'captcha'}) {
@@ -5618,7 +6080,7 @@
         $css_class .= ' style="'.$rowstyle.'"';
     }
     my $output = '<tr'.$css_class.'>'.
-                 '<td class="LC_left_item">'.$rowname.'</td><td class="LC_left_item" colspan="2">'."\n".
+                 '<td class="LC_left_item">'.$rowname.'</td><td class="LC_left_item" colspan="'.$colspan.'">'."\n".
                  '<table><tr><td>'."\n";
     foreach my $option ('original','recaptcha','notused') {
         $output .= '<span class="LC_nobreak"><label><input type="radio" name="'.$context.'_captcha" value="'.
@@ -5839,97 +6301,18 @@
                 my $includeempty = 1;
                 $datatable .= &Apache::loncommon::select_timezone($item,$defaults{$item},undef,$includeempty);
             } elsif ($item eq 'datelocale_def') {
-                my $includeempty = 1;
-                $datatable .= &Apache::loncommon::select_datelocale($item,$defaults{$item},undef,$includeempty);
-            } elsif ($item eq 'lang_def') {
-                my $includeempty = 1;
-                $datatable .= &Apache::loncommon::select_language($item,$defaults{$item},$includeempty);
-            } else {
-                my $size;
-                if ($item eq 'portal_def') {
-                    $size = ' size="25"';
-                }
-                $datatable .= '<input type="text" name="'.$item.'" value="'.
-                              $defaults{$item}.'"'.$size.' />';
-            }
-            $datatable .= '</td></tr>';
-            $rownum ++;
-        }
-    } elsif ($position eq 'middle') {
-        my @items = ('intauth_cost','intauth_check','intauth_switch');
-        my %defaults;
-        if (ref($settings) eq 'HASH') {
-            %defaults = %{$settings};
-            if ($defaults{'intauth_cost'} !~ /^\d+$/) {
-                $defaults{'intauth_cost'} = 10;
-            }
-            if ($defaults{'intauth_check'} !~ /^(0|1|2)$/) {
-                $defaults{'intauth_check'} = 0;
-            }
-            if ($defaults{'intauth_switch'} !~ /^(0|1|2)$/) {
-                $defaults{'intauth_switch'} = 0;
-            }
-        } else {
-            %defaults = (
-                          'intauth_cost'   => 10,
-                          'intauth_check'  => 0,
-                          'intauth_switch' => 0,
-                        );
-        }
-        foreach my $item (@items) {
-            if ($rownum%2) {
-                $css_class = '';
-            } else {
-                $css_class = ' class="LC_odd_row" ';
-            }
-            $datatable .= '<tr'.$css_class.'>'.
-                          '<td><span class="LC_nobreak">'.$titles->{$item}.
-                          '</span></td><td class="LC_left_item" colspan="3">';
-            if ($item eq 'intauth_switch') {
-                my @options = (0,1,2);
-                my %optiondesc = &Apache::lonlocal::texthash (
-                                   0 => 'No',
-                                   1 => 'Yes',
-                                   2 => 'Yes, and copy existing passwd file to passwd.bak file',
-                                 );
-                $datatable .= '<table width="100%">';
-                foreach my $option (@options) {
-                    my $checked = ' ';
-                    if ($defaults{$item} eq $option) {
-                        $checked = ' checked="checked"';
-                    }
-                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
-                                  '<label><input type="radio" name="'.$item.
-                                  '" value="'.$option.'"'.$checked.' />'.
-                                  $optiondesc{$option}.'</label></span></td></tr>';
-                }
-                $datatable .= '</table>';
-            } elsif ($item eq 'intauth_check') {
-                my @options = (0,1,2);
-                my %optiondesc = &Apache::lonlocal::texthash (
-                                   0 => 'No',
-                                   1 => 'Yes, allow login then update passwd file using default cost (if higher)',
-                                   2 => 'Yes, disallow login if stored cost is less than domain default',
-                                 );
-                $datatable .= '<table width="100%">';
-                foreach my $option (@options) {
-                    my $checked = ' ';
-                    my $onclick;
-                    if ($defaults{$item} eq $option) {
-                        $checked = ' checked="checked"';
-                    }
-                    if ($option == 2) {
-                        $onclick = ' onclick="javascript:warnIntAuth(this);"';
-                    }
-                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
-                                  '<label><input type="radio" name="'.$item.
-                                  '" value="'.$option.'"'.$checked.$onclick.' />'.
-                                  $optiondesc{$option}.'</label></span></td></tr>';
-                }
-                $datatable .= '</table>';
+                my $includeempty = 1;
+                $datatable .= &Apache::loncommon::select_datelocale($item,$defaults{$item},undef,$includeempty);
+            } elsif ($item eq 'lang_def') {
+                my $includeempty = 1;
+                $datatable .= &Apache::loncommon::select_language($item,$defaults{$item},$includeempty);
             } else {
+                my $size;
+                if ($item eq 'portal_def') {
+                    $size = ' size="25"';
+                }
                 $datatable .= '<input type="text" name="'.$item.'" value="'.
-                              $defaults{$item}.'" size="3" onblur="javascript:warnIntAuth(this);" />';
+                              $defaults{$item}.'"'.$size.' />';
             }
             $datatable .= '</td></tr>';
             $rownum ++;
@@ -6690,35 +7073,7 @@
 
 sub defaults_javascript {
     my ($settings) = @_;
-    my $intauthcheck = &mt('Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.');
-    my $intauthcost = &mt('Warning: bcrypt encryption cost for internal authentication must be an integer.');
-    &js_escape(\$intauthcheck);
-    &js_escape(\$intauthcost);
-    my $intauthjs = <<"ENDSCRIPT";
-
-function warnIntAuth(field) {
-    if (field.name == 'intauth_check') {
-        if (field.value == '2') {
-            alert('$intauthcheck');
-        }
-    }
-    if (field.name == 'intauth_cost') {
-        field.value.replace(/\s/g,'');
-        if (field.value != '') {
-            var regexdigit=/^\\d+\$/;
-            if (!regexdigit.test(field.value)) {
-                alert('$intauthcost');
-            }
-        }
-    }
-    return;
-}
-
-ENDSCRIPT
-
-    if (ref($settings) ne 'HASH') {
-        return &Apache::lonhtmlcommon::scripttag($intauthjs);
-    }
+    return unless (ref($settings) eq 'HASH');
     if ((ref($settings->{'inststatusorder'}) eq 'ARRAY') && (ref($settings->{'inststatustypes'}) eq 'HASH')) {
         my $maxnum = scalar(@{$settings->{'inststatusorder'}});
         if ($maxnum eq '') {
@@ -6772,17 +7127,42 @@
     return;
 }
 
-$intauthjs
-
 // ]]>
 </script>
 
 ENDSCRIPT
-    } else {
-        return &Apache::lonhtmlcommon::scripttag($intauthjs);
     }
 }
 
+sub passwords_javascript {
+    my $intauthcheck = &mt('Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.');
+    my $intauthcost = &mt('Warning: bcrypt encryption cost for internal authentication must be an integer.');
+    &js_escape(\$intauthcheck);
+    &js_escape(\$intauthcost);
+    my $intauthjs = <<"ENDSCRIPT";
+
+function warnIntAuth(field) {
+    if (field.name == 'intauth_check') {
+        if (field.value == '2') {
+            alert('$intauthcheck');
+        }
+    }
+    if (field.name == 'intauth_cost') {
+        field.value.replace(/\s/g,'');
+        if (field.value != '') {
+            var regexdigit=/^\\d+\$/;
+            if (!regexdigit.test(field.value)) {
+                alert('$intauthcost');
+            }
+        }
+    }
+    return;
+}
+
+ENDSCRIPT
+    return &Apache::lonhtmlcommon::scripttag($intauthjs);
+}
+
 sub coursecategories_javascript {
     my ($settings) = @_;
     my ($output,$jstext,$cathash);
@@ -7121,7 +7501,7 @@
         my $check = ' ';
         unless ($role eq 'emailusername') {
             if (exists($checks{$fields[$i]})) {
-                $check = $checks{$fields[$i]}
+                $check = $checks{$fields[$i]};
             } else {
                 if ($role eq 'st') {
                     if (ref($settings) ne 'HASH') {
@@ -8219,7 +8599,7 @@
     my ($configuserok,%currroles);
     if ($uhome eq 'no_host') {
         srand( time() ^ ($$ + ($$ << 15))  ); # Seed rand.
-        my $configpass = &LONCAPA::Enrollment::create_password();
+        my $configpass = &LONCAPA::Enrollment::create_password($dom);
         $configuserok = 
             &Apache::lonnet::modifyuser($dom,$confname,'','internal',
                              $configpass,'','','','','',undef,$servadm);
@@ -10140,6 +10520,514 @@
     return $resulttext;
 }
 
+sub modify_passwords {
+    my ($r,$dom,$confname,$lastactref,%domconfig) = @_;
+    my ($resulttext,%current,%changes,%newvalues, at oktypes,$errors,
+        $updatedefaults,$updateconf);
+    my $customfn = 'resetpw.html';
+    if (ref($domconfig{'passwords'}) eq 'HASH') {
+        %current = %{$domconfig{'passwords'}};
+    }
+    my %domdefaults = &Apache::lonnet::get_domain_defaults($dom,1);
+    my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
+    if (ref($types) eq 'ARRAY') {
+        @oktypes = @{$types};
+    }
+    push(@oktypes,'default');
+
+    my %titles = &Apache::lonlocal::texthash (
+        intauth_cost   => 'Encryption cost for bcrypt (positive integer)',
+        intauth_check  => 'Check bcrypt cost if authenticated',
+        intauth_switch => 'Existing crypt-based switched to bcrypt on authentication',
+        permanent      => 'Permanent e-mail address',
+        critical       => 'Critical notification address',
+        notify         => 'Notification address',
+        min            => 'Minimum password length',
+        max            => 'Maximum password length',
+        chars          => 'Required characters',
+        numsaved       => 'Number of previous passwords to save',
+        reset          => 'Resetting Forgotten Password',
+        intauth        => 'Encryption of Stored Passwords (Internal Auth)',
+        rules          => 'Rules for LON-CAPA Passwords',
+        crsownerchg    => 'Course Owner Changing Student Passwords',
+        username       => 'Username',
+        email          => 'E-mail address',
+    );
+
+#
+# Retrieve current domain configuration for internal authentication from $domconfig{'defaults'}.
+#
+    my (%curr_defaults,%save_defaults);
+    if (ref($domconfig{'defaults'}) eq 'HASH') {
+        foreach my $key (keys(%{$domconfig{'defaults'}})) {
+            if ($key =~ /^intauth_(cost|check|switch)$/) {
+                $curr_defaults{$key} = $domconfig{'defaults'}{$key};
+            } else {
+                $save_defaults{$key} = $domconfig{'defaults'}{$key};
+            }
+        }
+    }
+    my %staticdefaults = (
+        'resetlink'      => 2,
+        'resetcase'      => \@oktypes,
+        'resetprelink'   => 'both',
+        'resetemail'     => ['critical','notify','permanent'],
+        'intauth_cost'   => 10,
+        'intauth_check'  => 0,
+        'intauth_switch' => 0,
+        'min'            => 7,
+    );
+    foreach my $type (@oktypes) {
+        $staticdefaults{'resetpostlink'}{$type} = ['email','username'];
+    }
+    my $linklife = $env{'form.passwords_link'};
+    $linklife =~ s/^\s+|\s+$//g;
+    if (($linklife =~ /^\d+(|\.\d*)$/) && ($linklife > 0)) {
+        $newvalues{'resetlink'} = $linklife;
+        if ($current{'resetlink'}) {
+            if ($current{'resetlink'} ne $linklife) {
+                $changes{'reset'} = 1;
+            }
+        } elsif (!exists($domconfig{passwords})) {
+            if ($staticdefaults{'resetlink'} ne $linklife) {
+                $changes{'reset'} = 1;
+            }
+        }
+    } elsif ($current{'resetlink'}) {
+        $changes{'reset'} = 1;
+    }
+    my @casesens;
+    my @posscase = &Apache::loncommon::get_env_multiple('form.passwords_case_sensitive');
+    foreach my $case (sort(@posscase)) {
+        if (grep(/^\Q$case\E$/, at oktypes)) {
+            push(@casesens,$case);
+        }
+    }
+    $newvalues{'resetcase'} = \@casesens;
+    if (ref($current{'resetcase'}) eq 'ARRAY') {
+        my @diffs = &Apache::loncommon::compare_arrays($current{'resetcase'},\@casesens);
+        if (@diffs > 0) {
+            $changes{'reset'} = 1;
+        }
+    } elsif (!exists($domconfig{passwords})) {
+        my @diffs = &Apache::loncommon::compare_arrays($staticdefaults{'resetcase'},\@casesens);
+        if (@diffs > 0) {
+            $changes{'reset'} = 1;
+        }
+    }
+    if ($env{'form.passwords_prelink'} =~ /^(both|either)$/) {
+        $newvalues{'resetprelink'} = $env{'form.passwords_prelink'};
+        if (exists($current{'resetprelink'})) {
+            if ($current{'resetprelink'} ne $newvalues{'resetprelink'}) {
+                $changes{'reset'} = 1;
+            }
+        } elsif (!exists($domconfig{passwords})) {
+            if ($staticdefaults{'resetprelink'} ne $newvalues{'resetprelink'}) {
+                $changes{'reset'} = 1;
+            }
+        }
+    } elsif ($current{'resetprelink'}) {
+        $changes{'reset'} = 1;
+    }
+    foreach my $type (@oktypes) {
+        my @possplink = &Apache::loncommon::get_env_multiple('form.passwords_postlink_'.$type);
+        my @postlink;
+        foreach my $item (sort(@possplink)) {
+            if ($item =~ /^(email|username)$/) {
+                push(@postlink,$item);
+            }
+        }
+        $newvalues{'resetpostlink'}{$type} = \@postlink;
+        unless ($changes{'reset'}) {
+            if (ref($current{'resetpostlink'}) eq 'HASH') {
+                if (ref($current{'resetpostlink'}{$type}) eq 'ARRAY') {
+                    my @diffs = &Apache::loncommon::compare_arrays($current{'resetpostlink'}{$type},\@postlink);
+                    if (@diffs > 0) {
+                        $changes{'reset'} = 1;
+                    }
+                } else {
+                    $changes{'reset'} = 1;
+                }
+            } elsif (!exists($domconfig{passwords})) {
+                my @diffs = &Apache::loncommon::compare_arrays($staticdefaults{'resetpostlink'}{$type},\@postlink);
+                if (@diffs > 0) {
+                    $changes{'reset'} = 1;
+                }
+            }
+        }
+    }
+    my @possemailsrc = &Apache::loncommon::get_env_multiple('form.passwords_emailsrc');
+    my @resetemail;
+    foreach my $item (sort(@possemailsrc)) {
+        if ($item =~ /^(permanent|critical|notify)$/) {
+            push(@resetemail,$item);
+        }
+    }
+    $newvalues{'resetemail'} = \@resetemail;
+    unless ($changes{'reset'}) {
+        if (ref($current{'resetemail'}) eq 'ARRAY') {
+            my @diffs = &Apache::loncommon::compare_arrays($current{'resetemail'},\@resetemail);
+            if (@diffs > 0) {
+                $changes{'reset'} = 1;
+            }
+        } elsif (!exists($domconfig{passwords})) {
+            my @diffs = &Apache::loncommon::compare_arrays($staticdefaults{'resetemail'},\@resetemail);
+            if (@diffs > 0) {
+                $changes{'reset'} = 1;
+            }
+        }
+    }
+    if ($env{'form.passwords_stdtext'} == 0) {
+        $newvalues{'resetremove'} = 1;
+        unless ($current{'resetremove'}) {
+            $changes{'reset'} = 1;
+        }
+    } elsif ($current{'resetremove'}) {
+        $changes{'reset'} = 1;
+    }
+    if ($env{'form.passwords_customfile.filename'} ne '') {
+        my $servadm = $r->dir_config('lonAdmEMail');
+        my $servadm = $r->dir_config('lonAdmEMail');
+        my ($configuserok,$author_ok,$switchserver) =
+            &config_check($dom,$confname,$servadm);
+        my $error;
+        if ($configuserok eq 'ok') {
+            if ($switchserver) {
+                $error = &mt("Upload of file containing domain-specific text is not permitted to this server: [_1]",$switchserver);
+            } else {
+                if ($author_ok eq 'ok') {
+                    my ($result,$customurl) =
+                        &publishlogo($r,'upload','passwords_customfile',$dom,
+                                     $confname,'customtext/resetpw','','',$customfn);
+                    if ($result eq 'ok') {
+                        $newvalues{'resetcustom'} = $customurl;
+                        $changes{'reset'} = 1;
+                    } else {
+                        $error = &mt("Upload of [_1] failed because an error occurred publishing the file in RES space. Error was: [_2].",$customfn,$result);
+                    }
+                } else {
+                    $error = &mt("Upload of [_1] failed because an author role could not be assigned to a Domain Configuration user ([_2]) in domain: [_3].  Error was: [_4].",$customfn,$confname,$dom,$author_ok);
+                }
+            }
+        } else {
+            $error = &mt("Upload of [_1] failed because a Domain Configuration user ([_2]) could not be created in domain: [_3].  Error was: [_4].",$customfn,$confname,$dom,$configuserok);
+        }
+        if ($error) {
+            &Apache::lonnet::logthis($error);
+            $errors .= '<li><span class="LC_error">'.$error.'</span></li>';
+        }
+    } elsif ($current{'resetcustom'}) {
+        if ($env{'form.passwords_custom_del'}) {
+            $changes{'reset'} = 1;
+        } else {
+            $newvalues{'resetcustom'} = $current{'resetcustom'};
+        }
+    }
+    $env{'form.intauth_cost'} =~ s/^\s+|\s+$//g;
+    if (($env{'form.intauth_cost'} ne '') && ($env{'form.intauth_cost'} =~ /^\d+$/)) {
+        $save_defaults{'intauth_cost'} = $env{'form.intauth_cost'};
+        if ($save_defaults{'intauth_cost'} ne $curr_defaults{'intauth_cost'}) {
+            $changes{'intauth'} = 1;
+        }
+    } else {
+        $save_defaults{'intauth_cost'} = $curr_defaults{'intauth_cost'};
+    }
+    if ($env{'form.intauth_check'} =~ /^(0|1|2)$/) {
+        $save_defaults{'intauth_check'} = $env{'form.intauth_check'};
+        if ($save_defaults{'intauth_check'} ne $curr_defaults{'intauth_check'}) {
+            $changes{'intauth'} = 1;
+        }
+    } else {
+        $save_defaults{'intauth_check'} = $curr_defaults{'intauth_check'};
+    }
+    if ($env{'form.intauth_switch'} =~ /^(0|1|2)$/) {
+        $save_defaults{'intauth_switch'} = $env{'form.intauth_switch'};
+        if ($save_defaults{'intauth_switch'} ne $curr_defaults{'intauth_switch'}) {
+            $changes{'intauth'} = 1;
+        }
+    } else {
+        $save_defaults{'intauth_check'} = $curr_defaults{'intauth_check'};
+    }
+    foreach my $item ('cost','check','switch') {
+        if ($save_defaults{'intauth_'.$item} ne $domdefaults{'intauth_'.$item}) {
+            $domdefaults{'intauth_'.$item} = $save_defaults{'intauth_'.$item};
+            $updatedefaults = 1;
+        }
+    }
+    foreach my $rule ('min','max','numsaved') {
+        $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
+        if ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
+            $newvalues{$rule} = $env{'form.passwords_'.$rule};
+            if (exists($current{$rule})) {
+                if ($newvalues{$rule} ne $current{$rule}) {
+                    $changes{'rules'} = 1;
+                }
+            } elsif ($rule eq 'min') {
+                if ($staticdefaults{$rule} ne $newvalues{$rule}) {
+                    $changes{'rules'} = 1;
+                }
+            }
+        } elsif (exists($current{$rule})) {
+            $changes{'rules'} = 1;
+        }
+    }
+    my @posschars = &Apache::loncommon::get_env_multiple('form.passwords_chars');
+    my @chars;
+    foreach my $item (sort(@posschars)) {
+        if ($item =~ /^(uc|lc|num|spec)$/) {
+            push(@chars,$item);
+        }
+    }
+    $newvalues{'chars'} = \@chars;
+    unless ($changes{'rules'}) {
+        if (ref($current{'chars'}) eq 'ARRAY') {
+            my @diffs = &Apache::loncommon::compare_arrays($current{'chars'},\@chars);
+            if (@diffs > 0) {
+                $changes{'rules'} = 1;
+            }
+        } else {
+            if (@chars > 0) {
+                $changes{'rules'} = 1;
+            }
+        }
+    }
+    my %crsownerchg = (
+                        by => [],
+                        for => [],
+                      );
+    foreach my $item ('by','for') {
+        my @posstypes = &Apache::loncommon::get_env_multiple('form.passwords_crsowner_'.$item);
+        foreach my $type (sort(@posstypes)) {
+            if (grep(/^\Q$type\E$/, at oktypes)) {
+                push(@{$crsownerchg{$item}},$type);
+            }
+        }
+    }
+    $newvalues{'crsownerchg'} = \%crsownerchg;
+    if (ref($current{'crsownerchg'}) eq 'HASH') {
+        foreach my $item ('by','for') {
+            if (ref($current{'crsownerchg'}{$item}) eq 'ARRAY') {
+                my @diffs = &Apache::loncommon::compare_arrays($current{'crsownerchg'}{$item},$crsownerchg{$item});
+                if (@diffs > 0) {
+                    $changes{'crsownerchg'} = 1;
+                    last;
+                }
+            }
+        }
+    } elsif (!exists($domconfig{passwords})) {
+        foreach my $item ('by','for') {
+            if (@{$crsownerchg{$item}} > 0) {
+                $changes{'crsownerchg'} = 1;
+                last;
+            }
+        }
+    }
+
+    my %confighash = (
+                        defaults  => \%save_defaults,
+                        passwords => \%newvalues,
+                     );
+    &process_captcha('passwords',\%changes,$confighash{'passwords'},$domconfig{'passwords'});
+
+    my $putresult = &Apache::lonnet::put_dom('configuration',\%confighash,$dom);
+    if ($putresult eq 'ok') {
+        if (keys(%changes) > 0) {
+            $resulttext = &mt('Changes made: ').'<ul>';
+            foreach my $key ('reset','intauth','rules','crsownerchg') {
+                if ($changes{$key}) {
+                    unless ($key eq 'intauth') {
+                        $updateconf = 1;
+                    }
+                    $resulttext .= '<li>'.$titles{$key}.':<ul>';
+                    if ($key eq 'reset') {
+                        if ($confighash{'passwords'}{'captcha'} eq 'original') {
+                            $resulttext .= '<li>'.&mt('CAPTCHA validation set to use: original CAPTCHA').'</li>';
+                        } elsif ($confighash{'passwords'}{'captcha'} eq 'recaptcha') {
+                            $resulttext .= '<li>'.&mt('CAPTCHA validation set to use: reCAPTCHA').' '.
+                                           &mt('version: [_1]',$confighash{'passwords'}{'recaptchaversion'}).'<br />'.
+                                           &mt('Public key: [_1]',$confighash{'passwords'}{'recaptchapub'}).'</br>'.
+                                           &mt('Private key: [_1]',$confighash{'passwords'}{'recaptchapriv'}).'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('No CAPTCHA validation').'</li>';
+                        }
+                        if ($confighash{'passwords'}{'resetlink'}) {
+                            $resulttext .= '<li>'.&mt('Reset link expiration set to [quant,_1,hour]',$confighash{'passwords'}{'resetlink'}).'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('No reset link expiration set.').' '.
+                                                  &mt('Will default to 2 hours').'</li>';
+                        }
+                        if (ref($confighash{'passwords'}{'resetcase'}) eq 'ARRAY') {
+                            if (@{$confighash{'passwords'}{'resetcase'}} == 0) {
+                                $resulttext .= '<li>'.&mt('User input for username and/or e-mail address not case sensitive for "Forgot Password" web form').'</li>';
+                            } else {
+                                my $casesens;
+                                foreach my $type (@{$confighash{'passwords'}{'resetcase'}}) {
+                                    if ($type eq 'default') {
+                                        $casesens .= $othertitle.', ';
+                                    } elsif ($usertypes->{$type} ne '') {
+                                        $casesens .= $usertypes->{$type}.', ';
+                                    }
+                                }
+                                $casesens =~ s/\Q, \E$//;
+                                $resulttext .= '<li>'.&mt('"Forgot Password" web form input for username and/or e-mail address is case-sensitive for: [_1]',$casesens).'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('Case-sensitivity not set for "Forgot Password" web form').' '.&mt('Will default to case-sensitive for username and/or e-mail address for all').'</li>';
+                        }
+                        if ($confighash{'passwords'}{'resetprelink'} eq 'either') {
+                            $resulttext .= '<li>'.&mt('Users can enter either a username or an e-mail address in "Forgot Password" web form').'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('Users can enter both a username and an e-mail address in "Forgot Password" web form').'</li>';
+                        }
+                        if (ref($confighash{'passwords'}{'resetpostlink'}) eq 'HASH') {
+                            my $output;
+                            if (ref($types) eq 'ARRAY') {
+                                foreach my $type (@{$types}) {
+                                    if (ref($confighash{'passwords'}{'resetpostlink'}{$type}) eq 'ARRAY') {
+                                        if (@{$confighash{'passwords'}{'resetpostlink'}{$type}} == 0) {
+                                            $output .= $usertypes->{$type}.' -- '.&mt('none');
+                                        } else {
+                                            $output .= $usertypes->{$type}.' -- '.
+                                                       join(', ',map { $titles{$_}; } (@{$confighash{'passwords'}{'resetpostlink'}{$type}})).'; ';
+                                        }
+                                    }
+                                }
+                            }
+                            if (ref($confighash{'passwords'}{'resetpostlink'}{'default'}) eq 'ARRAY') {
+                                if (@{$confighash{'passwords'}{'resetpostlink'}{'default'}} == 0) {
+                                    $output .= $othertitle.' -- '.&mt('none');
+                                } else {
+                                    $output .= $othertitle.' -- '.
+                                               join(', ',map { $titles{$_}; } (@{$confighash{'passwords'}{'resetpostlink'}{'default'}}));
+                                }
+                            }
+                            if ($output) {
+                                $resulttext .= '<li>'.&mt('Information required for new password form (by user type) set to: [_1]',$output).'</li>';
+                            } else {
+                                $resulttext .= '<li>'.&mt('Information required for new password form not set.').' '.&mt('Will default to requiring both the username and an e-mail address').'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('Information required for new password form not set.').' '.&mt('Will default to requiring both the username and an e-mail address').'</li>';
+                        }
+                        if (ref($confighash{'passwords'}{'resetemail'}) eq 'ARRAY') {
+                            if (@{$confighash{'passwords'}{'resetemail'}} > 0) {
+                                $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA used for verification will include: [_1]',join(', ',map { $titles{$_}; } @{$confighash{'passwords'}{'resetemail'}})).'</li>';
+                            } else {
+                                $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA used for verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA usedfor verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
+                        }
+                        if ($confighash{'passwords'}{'resetremove'}) {
+                            $resulttext .= '<li>'.&mt('Preamble to "Forgot Password" web form not shown').'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('Preamble to "Forgot Password" web form is shown').'</li>';
+                        }
+                        if ($confighash{'passwords'}{'resetcustom'}) {
+                            my $customlink = &Apache::loncommon::modal_link($confighash{'passwords'}{'resetcustom'},
+                                                                            $titles{custom},600,500);
+                            $resulttext .= '<li>'.&mt('Preamble to "Forgot Password" form includes [_1]',$customlink).'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('No custom text included in preamble to "Forgot Password" form').'</li>';
+                        }
+                    } elsif ($key eq 'intauth') {
+                        foreach my $item ('cost','switch','check') {
+                            my $value = $save_defaults{$key.'_'.$item};
+                            if ($item eq 'switch') {
+                                my %optiondesc = &Apache::lonlocal::texthash (
+                                                     0 => 'No',
+                                                     1 => 'Yes',
+                                                     2 => 'Yes, and copy existing passwd file to passwd.bak file',
+                                                 );
+                                if ($value =~ /^(0|1|2)$/) {
+                                    $value = $optiondesc{$value};
+                                } else {
+                                    $value = &mt('none -- defaults to No');
+                                }
+                            } elsif ($item eq 'check') {
+                                my %optiondesc = &Apache::lonlocal::texthash (
+                                                     0 => 'No',
+                                                     1 => 'Yes, allow login then update passwd file using default cost (if higher)',
+                                                     2 => 'Yes, disallow login if stored cost is less than domain default',
+                                                 );
+                                if ($value =~ /^(0|1|2)$/) {
+                                    $value = $optiondesc{$value};
+                                } else {
+                                    $value = &mt('none -- defaults to No');
+                                }
+                            }
+                            $resulttext .= '<li>'.&mt('[_1] set to "[_2]"',$titles{$key.'_'.$item},$value).'</li>';
+                        }
+                    } elsif ($key eq 'rules') {
+                        foreach my $rule ('min','max','numsaved') {
+                            if ($confighash{'passwords'}{$rule} eq '') {
+                                if ($rule eq 'min') {
+                                    $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
+                                                   ' '.&mt('Default of 7 will be used').'</li>';
+                                } else {
+                                    $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
+                                }
+                            } else {
+                                $resulttext .= '<li>'.&mt('[_1] set to [_2]',$titles{$rule},$confighash{'passwords'}{$rule}).'</li>';
+                            }
+                        }
+                    } elsif ($key eq 'crsownerchg') {
+                        if (ref($confighash{'passwords'}{'crsownerchg'}) eq 'HASH') {
+                            if ((@{$confighash{'passwords'}{'crsownerchg'}{'by'}} == 0) ||
+                                (@{$confighash{'passwords'}{'crsownerchg'}{'for'}} == 0)) {
+                                $resulttext .= '<li>'.&mt('Course owner may not change student passwords.').'</li>';
+                            } else {
+                                my %crsownerstr;
+                                foreach my $item ('by','for') {
+                                    if (ref($confighash{'passwords'}{'crsownerchg'}{$item}) eq 'ARRAY') {
+                                        foreach my $type (@{$confighash{'passwords'}{'crsownerchg'}{$item}}) {
+                                            if ($type eq 'default') {
+                                                $crsownerstr{$item} .= $othertitle.', ';
+                                            } elsif ($usertypes->{$type} ne '') {
+                                                $crsownerstr{$item} .= $usertypes->{$type}.', ';
+                                            }
+                                        }
+                                        $crsownerstr{$item} =~ s/\Q, \E$//;
+                                    }
+                                }
+                                $resulttext .= '<li>'.&mt('Course owner (with status: [_1]) may change passwords for students (with status: [_2]).',
+                                           $crsownerstr{'by'},$crsownerstr{'for'}).'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('Course owner may not change student passwords.').'</li>';
+                        }
+                    }
+                    $resulttext .= '</ul></li>';
+                }
+            }
+            $resulttext .= '</ul>';
+        } else {
+            $resulttext = &mt('No changes made to password settings');
+        }
+        my $cachetime = 24*60*60;
+        if ($updatedefaults) {
+            &Apache::lonnet::do_cache_new('domdefaults',$dom,\%domdefaults,$cachetime);
+            if (ref($lastactref) eq 'HASH') {
+                $lastactref->{'domdefaults'} = 1;
+            }
+        }
+        if ($updateconf) {
+            &Apache::lonnet::do_cache_new('passwdconf',$dom,$confighash{'passwords'},$cachetime);
+            if (ref($lastactref) eq 'HASH') {
+                $lastactref->{'passwdconf'} = 1;
+            }
+        }
+    } else {
+        $resulttext = '<span class="LC_error">'.
+            &mt('An error occurred: [_1]',$putresult).'</span>';
+    }
+    if ($errors) {
+        $resulttext .= '<p>'.&mt('The following errors occurred: ').'<ul>'.
+                       $errors.'</ul></p>';
+    }
+    return $resulttext;
+}
+
 sub modify_usercreation {
     my ($dom,%domconfig) = @_;
     my ($resulttext,%curr_usercreation,%changes,%authallowed,%cancreate,%save_usercreate);
@@ -11406,7 +12294,7 @@
     my ($resulttext,$mailmsgtxt,%newvalues,%changes, at errors);
     my %domdefaults = &Apache::lonnet::get_domain_defaults($dom,1);
     my @items = ('auth_def','auth_arg_def','lang_def','timezone_def','datelocale_def',
-                 'portal_def','intauth_cost','intauth_check','intauth_switch');
+                 'portal_def');
     my @authtypes = ('internal','krb4','krb5','localauth');
     foreach my $item (@items) {
         $newvalues{$item} = $env{'form.'.$item};
@@ -11448,24 +12336,6 @@
                     push(@errors,$item);
                 }
             }
-        } elsif ($item eq 'intauth_cost') {
-            if ($newvalues{$item} ne '') {
-                if ($newvalues{$item} =~ /\D/) {
-                    push(@errors,$item);
-                }
-            }
-        } elsif ($item eq 'intauth_check') {
-            if ($newvalues{$item} ne '') {
-                unless ($newvalues{$item} =~ /^(0|1|2)$/) {
-                    push(@errors,$item);
-                }
-            }
-        } elsif ($item eq 'intauth_switch') {
-            if ($newvalues{$item} ne '') {
-                unless ($newvalues{$item} =~ /^(0|1|2)$/) {
-                    push(@errors,$item);
-                }
-            }
         }
         if (grep(/^\Q$item\E$/, at errors)) {
             $newvalues{$item} = $domdefaults{$item};
@@ -11474,6 +12344,18 @@
         }
         $domdefaults{$item} = $newvalues{$item};
     }
+    my %staticdefaults = (
+                           'intauth_cost'   => 10,
+                           'intauth_check'  => 0,
+                           'intauth_switch' => 0,
+                         );
+    foreach my $item ('intauth_cost','intauth_check','intauth_switch') {
+        if (exists($domdefaults{$item})) {
+            $newvalues{$item} = $domdefaults{$item};
+        } else {
+            $newvalues{$item} = $staticdefaults{$item};
+        }
+    }
     my %defaults_hash = (
                          defaults => \%newvalues,
                         );
@@ -11603,28 +12485,6 @@
                                           localauth  => 'loc',
                         );
                         $value = $authnames{$shortauth{$value}};
-                    } elsif ($item eq 'intauth_switch') {
-                        my %optiondesc = &Apache::lonlocal::texthash (
-                                            0 => 'No',
-                                            1 => 'Yes',
-                                            2 => 'Yes, and copy existing passwd file to passwd.bak file',
-                                         );
-                        if ($value =~ /^(0|1|2)$/) {
-                            $value = $optiondesc{$value};
-                        } else {
-                            $value = &mt('none -- defaults to No');
-                        }
-                    } elsif ($item eq 'intauth_check') {
-                        my %optiondesc = &Apache::lonlocal::texthash (
-                                             0 => 'No',
-                                             1 => 'Yes, allow login then update passwd file using default cost (if higher)',
-                                             2 => 'Yes, disallow login if stored cost is less than domain default',
-                                         );
-                        if ($value =~ /^(0|1|2)$/) {
-                            $value = $optiondesc{$value};
-                        } else {
-                            $value = &mt('none -- defaults to No');
-                        }
                     }
                     $resulttext .= '<li>'.&mt('[_1] set to "[_2]"',$title->{$item},$value).'</li>';
                     $mailmsgtext .= "$title->{$item} set to $value\n";  
@@ -14533,7 +15393,8 @@
     my %servers = &Apache::lonnet::internet_dom_servers($dom);
     my %thismachine;
     map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
-    my @posscached = ('domainconfig','domdefaults','usersessions','directorysrch','cats');
+    my @posscached = ('domainconfig','domdefaults','usersessions',
+                      'directorysrch','passwdconf','cats');
     if (keys(%servers)) {
         foreach my $server (keys(%servers)) {
             next if ($thismachine{$server});

From raeburn at source.lon-capa.org  Wed Aug 21 18:41:13 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Wed, 21 Aug 2019 22:41:13 -0000
Subject: [LON-CAPA-cvs] cvs: loncom /interface lonpreferences.pm
Message-ID: <cvsraeburn1566427273@cvsserver>

raeburn		Wed Aug 21 22:41:13 2019 EDT

  Modified files:              
    /loncom/interface	lonpreferences.pm 
  Log:
  - Remove trailing whitespace.
  
  
Index: loncom/interface/lonpreferences.pm
diff -u loncom/interface/lonpreferences.pm:1.234 loncom/interface/lonpreferences.pm:1.235
--- loncom/interface/lonpreferences.pm:1.234	Mon May  6 18:19:16 2019
+++ loncom/interface/lonpreferences.pm	Wed Aug 21 22:41:13 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Preferences
 #
-# $Id: lonpreferences.pm,v 1.234 2019/05/06 18:19:16 raeburn Exp $
+# $Id: lonpreferences.pm,v 1.235 2019/08/21 22:41:13 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -363,7 +363,7 @@
 &Apache::lonhtmlcommon::row_closure(1).
 &Apache::lonhtmlcommon::end_pick_box().'
 </div>');
-    if ($roles_check_list) { 
+    if ($roles_check_list) {
         $r->print('<div class="LC_left_float">
 <h4>'.&mt('Freeze Roles').'</h4>
 <p>'.&mt('The table below can be used to [_1]freeze[_2] '.$lc_role.'s in the Hotlist.','<q>','</q>').'<br />'.
@@ -1408,7 +1408,7 @@
 |;
         }
         if ((ref($extrafields) eq 'HASH') && ($extrafields->{'email'})) {
-            $output .= qq| 
+            $output .= qq|
         this.document.pserver.elements.email.value =
                    this.document.client.elements.email.value;
 |;
@@ -1444,7 +1444,7 @@
                       .&Apache::lonhtmlcommon::row_closure();
         }
         if ((ref($extrafields) eq 'HASH') && ($extrafields->{'username'})) {
-            $output .= &Apache::lonhtmlcommon::row_title(  
+            $output .= &Apache::lonhtmlcommon::row_title(
                        '<label for="uname">'.$lt{'username'}.'</label>')
                       .'<input type="text" name="uname" size="20" autocapitalize="off" autocorrect="off" />'
                       .&Apache::lonhtmlcommon::row_closure()
@@ -2306,7 +2306,7 @@
     } else {
         $brlink ='/adm/preferences';
         $brtxt = 'Set User Preferences';
-        $brhelp = 'Prefs_About_Me,Prefs_Language,Prefs_Screen_Name_Nickname,Change_Colors,Change_Password,Prefs_Messages,Change_Discussion_Display';   
+        $brhelp = 'Prefs_About_Me,Prefs_Language,Prefs_Screen_Name_Nickname,Change_Colors,Change_Password,Prefs_Messages,Change_Discussion_Display';
     }
     Apache::lonhtmlcommon::add_breadcrumb
         ({href => $brlink,



From raeburn at source.lon-capa.org  Wed Aug 21 20:00:03 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Thu, 22 Aug 2019 00:00:03 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface
	lonpreferences.pm
Message-ID: <cvsraeburn1566432003@cvsserver>

raeburn		Thu Aug 22 00:00:03 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	lonpreferences.pm 
  Log:
  - For 2.11
    Backport 1.228, 1.229, 1.230, 1.231, 1.232, 1.233, 1.234
  
  
-------------- next part --------------
Index: loncom/interface/lonpreferences.pm
diff -u loncom/interface/lonpreferences.pm:1.196.4.24 loncom/interface/lonpreferences.pm:1.196.4.25
--- loncom/interface/lonpreferences.pm:1.196.4.24	Mon Sep  3 14:03:03 2018
+++ loncom/interface/lonpreferences.pm	Thu Aug 22 00:00:03 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Preferences
 #
-# $Id: lonpreferences.pm,v 1.196.4.24 2018/09/03 14:03:03 raeburn Exp $
+# $Id: lonpreferences.pm,v 1.196.4.25 2019/08/22 00:00:03 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -27,8 +27,6 @@
 #
 # This package uses the "londes.js" javascript code. 
 #
-# TODOs that have to be completed:
-#    interface with lonnet to change the password
  
 package Apache::lonpreferences;
 
@@ -477,7 +475,6 @@
 }
 
 
-
 ################################################################
 #         Anonymous Discussion Name Change Subroutines         #
 ################################################################
@@ -1229,7 +1226,7 @@
 #            password handler subroutines            #
 ######################################################
 sub passwordchanger {
-    my ($r,$errormessage,$caller,$mailtoken) = @_;
+    my ($r,$errormessage,$caller,$mailtoken,$timelimit,$extrafields) = @_;
     # This function is a bit of a mess....
     # Passwords are encrypted using londes.js (DES encryption)
     $errormessage = ($errormessage || '');
@@ -1254,42 +1251,42 @@
             $caller = 'preferences';
         }
     } elsif ($caller eq 'reset_by_email') {
-            my %data = &Apache::lonnet::tmpget($mailtoken);
-            if (keys(%data) == 0) {
-                $r->print(
-                    '<p class="LC_warning">'
-                   .&mt('Sorry, the URL you provided to complete the reset of your password was invalid. Either the token included in the URL has been deleted or the URL you provided was invalid. Please submit a [_1]new request[_2] for a password reset, and follow the link to the new URL included in the e-mail that will be sent to you, to allow you to enter a new password.'
-                             ,'<a href="/adm/resetpw">','</a>')
-                   .'</p>'
-                );
-                return;
-            }
-            if (defined($data{time})) {
-                if (time - $data{'time'} < 7200) {
-                    $user = $data{'username'};
-                    $domain = $data{'domain'};
-                    $currentpass = $data{'temppasswd'};
-                } else {
-                    $r->print(
-                        '<p class="LC_warning">'
-                       .&mt('Sorry, the token generated when you requested'
-                           .' a password reset has expired.')
-                       .'</p>'
-                    );
-                    return;
-                }
+        my %data = &Apache::lonnet::tmpget($mailtoken);
+        if (keys(%data) == 0) {
+            $r->print(
+                '<p class="LC_warning">'
+               .&mt('Sorry, the URL you provided to complete the reset of your password was invalid. Either the token included in the URL has been deleted or the URL you provided was invalid. Please submit a [_1]new request[_2] for a password reset, and follow the link to the new URL included in the e-mail that will be sent to you, to allow you to enter a new password.'
+                   ,'<a href="/adm/resetpw">','</a>')
+               .'</p>'
+            );
+            return;
+        }
+        if (defined($data{time})) {
+            if (time - $data{'time'} < $timelimit) {
+                $user = $data{'username'};
+                $domain = $data{'domain'};
+                $currentpass = $data{'temppasswd'};
             } else {
                 $r->print(
-                   '<p class="LC_warning">'
-                  .&mt('Sorry, the URL generated when you requested reset of'
-                      .' your password contained incomplete information.')
+                    '<p class="LC_warning">'
+                   .&mt('Sorry, the token generated when you requested'
+                       .' a password reset has expired.')
                    .'</p>'
                 );
                 return;
             }
-            if (&Apache::lonnet::domain($domain) eq '') {
-                $domain = $r->dir_config('lonDefDomain');
-            }
+        } else {
+            $r->print(
+                '<p class="LC_warning">'
+                .&mt('Sorry, the URL generated when you requested reset of'
+                    .' your password contained incomplete information.')
+                .'</p>'
+            );
+            return;
+        }
+        if (&Apache::lonnet::domain($domain) eq '') {
+            $domain = $r->dir_config('lonDefDomain');
+        }
     } else {
         $r->print(
             '<p class="LC_error">'
@@ -1328,7 +1325,7 @@
 	my $jsh=Apache::File->new($include."/londes.js");
 	$r->print(<$jsh>);
     }
-    $r->print(&jscript_send($caller));
+    $r->print(&jscript_send($caller,$extrafields));
     $r->print(<<ENDFORM);
 $errormessage
 
@@ -1337,15 +1334,15 @@
      ensure that unencrypted passwords will not be sent out by a
      crappy browser -->
 ENDFORM
-    $r->print(&server_form($logtoken,$caller,$mailtoken));
-    $r->print(&client_form($caller,\%hexkey,$currentpass,$domain));
+    $r->print(&server_form($logtoken,$caller,$mailtoken,$extrafields));
+    $r->print(&client_form($caller,\%hexkey,$currentpass,$domain,$extrafields));
 
     #
     return;
 }
 
 sub jscript_send {
-    my ($caller) = @_;
+    my ($caller,$extrafields) = @_;
     my $output = qq|
 <script type="text/javascript" language="JavaScript">
 
@@ -1367,14 +1364,20 @@
             =getCrypted(this.document.client.elements.newpass_2.value);
 |;
     if ($caller eq 'reset_by_email') {
-        $output .= qq|
+        if ((ref($extrafields) eq 'HASH') && ($extrafields->{'username'})) {
+            $output .= qq|
         this.document.pserver.elements.uname.value =
                    this.document.client.elements.uname.value;
         this.document.pserver.elements.udom.value =
                    this.document.client.elements.udom.options[this.document.client.elements.udom.selectedIndex].value;
+|;
+        }
+        if ((ref($extrafields) eq 'HASH') && ($extrafields->{'email'})) {
+            $output .= qq|
         this.document.pserver.elements.email.value =
                    this.document.client.elements.email.value;
 |;
+        }
     }
     $ output .= qq|
         this.document.pserver.submit();
@@ -1385,7 +1388,7 @@
 }
 
 sub client_form {
-    my ($caller,$hexkey,$currentpass,$defdom) = @_;
+    my ($caller,$hexkey,$currentpass,$defdom,$extrafields) = @_;
     my %lt=&Apache::lonlocal::texthash(
                 'email' => 'E-mail Address',
                 'username' => 'Username',
@@ -1399,25 +1402,22 @@
     my $output = '<form name="client" action="">'
                 .&Apache::lonhtmlcommon::start_pick_box();
     if ($caller eq 'reset_by_email') {
-        my $mobileargs;
-        (undef,undef,undef,undef,undef,undef,my $clientmobile) =
-            &Apache::loncommon::decode_user_agent();
-        if ($clientmobile) {
-            $mobileargs = 'autocapitalize="off" autocorrect="off" ';
-        }
-        $output .= &Apache::lonhtmlcommon::row_title(
+        if ((ref($extrafields) eq 'HASH') && ($extrafields->{'email'})) {
+            $output .= &Apache::lonhtmlcommon::row_title(
                        '<label for="email">'.$lt{'email'}.'</label>')
-                  .'<input type="text" name="email" size="30" '.$mobileargs.'/>'
-                  .&Apache::lonhtmlcommon::row_closure()
-                  .&Apache::lonhtmlcommon::row_title(
+                      .'<input type="text" name="email" size="30" autocapitalize="off" autocorrect="off" />'
+                      .&Apache::lonhtmlcommon::row_closure();
+        }
+        if ((ref($extrafields) eq 'HASH') && ($extrafields->{'username'})) {
+            $output .= &Apache::lonhtmlcommon::row_title(
                        '<label for="uname">'.$lt{'username'}.'</label>')
-                  .'<input type="text" name="uname" size="20" '.$mobileargs.'/>'
-                  .'<input type="hidden" name="currentpass" value="'.$currentpass.'" />'
-                  .&Apache::lonhtmlcommon::row_closure()
-                  .&Apache::lonhtmlcommon::row_title(
+                      .'<input type="text" name="uname" size="20" autocapitalize="off" autocorrect="off" />'
+                      .&Apache::lonhtmlcommon::row_closure()
+                      .&Apache::lonhtmlcommon::row_title(
                        '<label for="udom">'.$lt{'domain'}.'</label>')
-                  .&Apache::loncommon::select_dom_form($defdom,'udom')
-                  .&Apache::lonhtmlcommon::row_closure();
+                      .&Apache::loncommon::select_dom_form($defdom,'udom')
+                      .&Apache::lonhtmlcommon::row_closure();
+        }
     } else {
         $output .= &Apache::lonhtmlcommon::row_title(
                        '<label for="currentpass">'.$lt{'currentpass'}.'</label>')
@@ -1433,6 +1433,9 @@
               .'<input type="password" name="newpass_2" size="20" />'
               .&Apache::lonhtmlcommon::row_closure(1)
               .&Apache::lonhtmlcommon::end_pick_box();
+    if ($caller eq 'reset_by_email') {
+        $output .= '<input type="hidden" name="currentpass" value="'.$currentpass.'" />';
+    }
     $output .= '<p><input type="button" value="'.$lt{'changepass'}.'" onclick="send();" /></p>'
               .qq|
 <input type="hidden" name="ukey_cpass"  value="$hexkey->{'ukey_cpass'}" />
@@ -1448,7 +1451,7 @@
 }
 
 sub server_form {
-    my ($logtoken,$caller,$mailtoken) = @_;
+    my ($logtoken,$caller,$mailtoken,$extrafields) = @_;
     my $action = '/adm/preferences';
     if ($caller eq 'reset_by_email') {
         $action = '/adm/resetpw';
@@ -1459,15 +1462,22 @@
 <input type="hidden" name="currentpass" value="" />
 <input type="hidden" name="newpass_1"   value="" />
 <input type="hidden" name="newpass_2"   value="" />
-    |;
+|;
     if ($caller eq 'reset_by_email') {
         $output .=  qq|
 <input type="hidden" name="token"   value="$mailtoken" />
+|;
+       if ((ref($extrafields) eq 'HASH') && ($extrafields->{'username'})) {
+           $output .=  qq|
 <input type="hidden" name="uname"   value="" />
 <input type="hidden" name="udom"   value="" />
+|;
+       }
+       if ((ref($extrafields) eq 'HASH') && ($extrafields->{'email'})) {
+           $output .=  qq|
 <input type="hidden" name="email"   value="" />
-
 |;
+       }
     }
     $output .= qq|
 <input type="hidden" name="action" value="verify_and_change_pass" />
@@ -1553,7 +1563,7 @@
         return 1;
     }
     my ($ckey,$n1key,$n2key)=split(/&/,$tmpinfo);
-    # 
+    #
     $currentpass = &Apache::loncommon::des_decrypt($ckey ,$currentpass);
     $newpass1    = &Apache::loncommon::des_decrypt($n1key,$newpass1);
     $newpass2    = &Apache::loncommon::des_decrypt($n2key,$newpass2);
@@ -1574,7 +1584,7 @@
                          &mt('Please try again.').'</span>',$caller,$mailtoken);
             return 1;
         }
-    } 
+    }
     if ($newpass1 ne $newpass2) {
 	&passwordchanger($r,
 			 '<span class="LC_warning">'.
@@ -1582,12 +1592,23 @@
 			 &mt('Please try again.').'</span>',$caller,$mailtoken);
 	return 1;
     }
-    if (length($newpass1) < 7) {
-	&passwordchanger($r,
-			 '<span class="LC_warning">'.
-			 &mt('Passwords must be a minimum of 7 characters long.').'  '.
-			 &mt('Please try again.').'</span>',$caller,$mailtoken);
-	return 1;
+    if ($currentauth eq 'unix:') {
+        if (length($newpass1) < 7) {
+            &passwordchanger($r,
+                             '<span class="LC_warning">'.
+                             &mt('Passwords must be a minimum of 7 characters long.').'  '.
+                             &mt('Please try again.').'</span>',$caller,$mailtoken);
+            return 1;
+        }
+    } else {
+        my $warning = &Apache::loncommon::check_passwd_rules($domain,$newpass1);
+        if ($warning) {
+	    &passwordchanger($r,'<span class="LC_warning">'.
+                             $warning.
+			     &mt('Please try again.').'</span>',
+                             $caller,$mailtoken);
+	    return 1;
+        }
     }
     #
     # Check for bad characters
@@ -1635,8 +1656,14 @@
                 return $result;
             }
         } else {
+            my $feedback;
+            if ($result eq 'prioruse') {
+                $feedback = &mt('Please enter a password that you have not used recently.');
+            } else {
+                $feedback = &mt('Please make sure your old password was entered correctly.');
+            }
             $message = &Apache::lonhtmlcommon::confirm_success(
-                &mt("The password for user [_1] was not changed.",'<i>'.$user.'</i>').' '.&mt('Please make sure your old password was entered correctly.'),1);
+                &mt("The password for user [_1] was not changed.",'<i>'.$user.'</i>').' '.$feedback,1);
             $message=&Apache::loncommon::confirmwrapper($message);
             &print_main_menu($r, $message);
             if (ref($ended)) {

From raeburn at source.lon-capa.org  Wed Aug 21 20:11:05 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Thu, 22 Aug 2019 00:11:05 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface loncommon.pm
Message-ID: <cvsraeburn1566432665@cvsserver>

raeburn		Thu Aug 22 00:11:05 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	loncommon.pm 
  Log:
  - For 2.11
    Backport 1.1327, 1.1331, 1.1332
  
  
Index: loncom/interface/loncommon.pm
diff -u loncom/interface/loncommon.pm:1.1075.2.136 loncom/interface/loncommon.pm:1.1075.2.137
--- loncom/interface/loncommon.pm:1.1075.2.136	Sun Aug  4 01:02:40 2019
+++ loncom/interface/loncommon.pm	Thu Aug 22 00:11:04 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common routines
 #
-# $Id: loncommon.pm,v 1.1075.2.136 2019/08/04 01:02:40 raeburn Exp $
+# $Id: loncommon.pm,v 1.1075.2.137 2019/08/22 00:11:04 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -3171,6 +3171,78 @@
     return ($authnum,%can_assign);
 }
 
+sub check_passwd_rules {
+    my ($domain,$plainpass) = @_;
+    my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
+    my ($min,$max, at chars, at brokerule,$warning);
+    if (ref($passwdconf{'chars'}) eq 'ARRAY') {
+        if ($passwdconf{'min'} =~ /^\d+$/) {
+            $min = $passwdconf{'min'};
+        }
+        if ($passwdconf{'max'} =~ /^\d+$/) {
+            $max = $passwdconf{'max'};
+        }
+        @chars = @{$passwdconf{'chars'}};
+    } else {
+        $min = 7;
+    }
+    if (($min) && (length($plainpass) < $min)) {
+        push(@brokerule,'min');
+    }
+    if (($max) && (length($plainpass) > $max)) {
+        push(@brokerule,'max');
+    }
+    if (@chars) {
+        my %rules;
+        map { $rules{$_} = 1; } @chars;
+        if ($rules{'uc'}) {
+            unless ($plainpass =~ /[A-Z]/) {
+                push(@brokerule,'uc');
+            }
+        }
+        if ($rules{'lc'}) {
+            unless ($plainpass =~ /[a-z]/) {
+                push(@brokerule,'lc');
+            }
+        }
+        if ($rules{'num'}) {
+            unless ($plainpass =~ /\d/) {
+                push(@brokerule,'num');
+            }
+        }
+        if ($rules{'spec'}) {
+            unless ($plainpass =~ /[!"#$%&'()*+,\-.\/:;<=>?@[\\\]^_`{|}~]/) {
+                push(@brokerule,'spec');
+            }
+        }
+    }
+    if (@brokerule) {
+        my %rulenames = &Apache::lonlocal::texthash(
+            uc   => 'At least one upper case letter',
+            lc   => 'At least one lower case letter',
+            num  => 'At least one number',
+            spec => 'At least one non-alphanumeric',
+        );
+        $rulenames{'uc'} .= ': ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+        $rulenames{'lc'} .= ': abcdefghijklmnopqrstuvwxyz';
+        $rulenames{'num'} .= ': 0123456789';
+        $rulenames{'spec'} .= ': !&quot;\#$%&amp;\'()*+,-./:;&lt;=&gt;?@[\]^_\`{|}~';
+        $rulenames{'min'} = &mt('Minimum password length: [_1]',$min);
+        $rulenames{'max'} = &mt('Maximum password length: [_1]',$max);
+        $warning = &mt('Password did not satisfy the following:').'<ul>';
+        foreach my $rule ('min','max','uc','ls','num','spec') {
+            if (grep(/^$rule$/, at brokerule)) {
+                $warning .= '<li>'.$rulenames{$rule}.'</li>';
+            }
+        }
+        $warning .= '</ul>';
+    }
+    if (wantarray) {
+        return @brokerule;
+    }
+    return $warning;
+}
+
 ###############################################################
 ##    Get Kerberos Defaults for Domain                 ##
 ###############################################################
@@ -16668,10 +16740,10 @@
 }
 
 sub captcha_display {
-    my ($context,$lonhost) = @_;
+    my ($context,$lonhost,$defdom) = @_;
     my ($output,$error);
     my ($captcha,$pubkey,$privkey,$version) =
-        &get_captcha_config($context,$lonhost);
+        &get_captcha_config($context,$lonhost,$defdom);
     if ($captcha eq 'original') {
         $output = &create_captcha();
         unless ($output) {
@@ -16687,9 +16759,9 @@
 }
 
 sub captcha_response {
-    my ($context,$lonhost) = @_;
+    my ($context,$lonhost,$defdom) = @_;
     my ($captcha_chk,$captcha_error);
-    my ($captcha,$pubkey,$privkey,$version) = &get_captcha_config($context,$lonhost);
+    my ($captcha,$pubkey,$privkey,$version) = &get_captcha_config($context,$lonhost,$defdom);
     if ($captcha eq 'original') {
         ($captcha_chk,$captcha_error) = &check_captcha();
     } elsif ($captcha eq 'recaptcha') {
@@ -16701,7 +16773,7 @@
 }
 
 sub get_captcha_config {
-    my ($context,$lonhost) = @_;
+    my ($context,$lonhost,$dom_in_effect) = @_;
     my ($captcha,$pubkey,$privkey,$version,$hashtocheck);
     my $hostname = &Apache::lonnet::hostname($lonhost);
     my $serverhomeID = &Apache::lonnet::get_server_homeID($hostname);
@@ -16749,6 +16821,27 @@
         } elsif ($domconfhash{$serverhomedom.'.login.captcha'} eq 'original') {
             $captcha = 'original';
         }
+    } elsif ($context eq 'passwords') {
+        if ($dom_in_effect) {
+            my %passwdconf = &Apache::lonnet::get_passwdconf($dom_in_effect);
+            if ($passwdconf{'captcha'} eq 'recaptcha') {
+                if (ref($passwdconf{'recaptchakeys'}) eq 'HASH') {
+                    $pubkey = $passwdconf{'recaptchakeys'}{'public'};
+                    $privkey = $passwdconf{'recaptchakeys'}{'private'};
+                }
+                if ($privkey && $pubkey) {
+                    $captcha = 'recaptcha';
+                    $version = $passwdconf{'recaptchaversion'};
+                    if ($version ne '2') {
+                        $version = 1;
+                    }
+                } else {
+                    $captcha = 'original';
+                }
+            } elsif ($passwdconf{'captcha'} ne 'notused') {
+                $captcha = 'original';
+            }
+        }
     }
     return ($captcha,$pubkey,$privkey,$version);
 }



From raeburn at source.lon-capa.org  Wed Aug 21 20:16:40 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Thu, 22 Aug 2019 00:16:40 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /lonnet/perl lonnet.pm
Message-ID: <cvsraeburn1566433000@cvsserver>

raeburn		Thu Aug 22 00:16:40 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/lonnet/perl	lonnet.pm 
  Log:
  - For 2.11
    Backport 1.1407, 1.1408
  
  
Index: loncom/lonnet/perl/lonnet.pm
diff -u loncom/lonnet/perl/lonnet.pm:1.1172.2.112 loncom/lonnet/perl/lonnet.pm:1.1172.2.113
--- loncom/lonnet/perl/lonnet.pm:1.1172.2.112	Mon Aug 19 17:57:03 2019
+++ loncom/lonnet/perl/lonnet.pm	Thu Aug 22 00:16:39 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # TCP networking package
 #
-# $Id: lonnet.pm,v 1.1172.2.112 2019/08/19 17:57:03 raeburn Exp $
+# $Id: lonnet.pm,v 1.1172.2.113 2019/08/22 00:16:39 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -1196,6 +1196,9 @@
     } elsif ($answer =~ "invalid_client") {
         &logthis("$server refused to change $uname in $udom password because ".
                  "it was a reset by e-mail originating from an invalid server.");
+    } elsif ($answer =~ "^prioruse") {
+       &logthis("$server refused to change $uname in $udom password because ".
+                "the password had been used before");
     }
     return $answer;
 }
@@ -2465,6 +2468,29 @@
     return $totcodes;
 }
 
+# --------------------------------------------- Get domain config for passwords
+
+sub get_passwdconf {
+    my ($dom) = @_;
+    my (%passwdconf,$gotconf,$lookup);
+    my ($result,$cached)=&is_cached_new('passwdconf',$dom);
+    if (defined($cached)) {
+        if (ref($result) eq 'HASH') {
+            %passwdconf = %{$result};
+            $gotconf = 1;
+        }
+    }
+    unless ($gotconf) {
+        my %domconfig = &get_dom('configuration',['passwords'],$dom);
+        if (ref($domconfig{'passwords'}) eq 'HASH') {
+            %passwdconf = %{$domconfig{'passwords'}};
+        }
+        my $cachetime = 24*60*60;
+        &do_cache_new('passwdconf',$dom,\%passwdconf,$cachetime);
+    }
+    return %passwdconf;
+}
+
 # --------------------------------------------------- Assign a key to a student
 
 sub assign_access_key {



From raeburn at source.lon-capa.org  Thu Aug 22 10:51:52 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Thu, 22 Aug 2019 14:51:52 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) / lond
Message-ID: <cvsraeburn1566485512@cvsserver>

raeburn		Thu Aug 22 14:51:52 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom	lond 
  Log:
  - For 2.11
    Backport 1.558
  
  
Index: loncom/lond
diff -u loncom/lond:1.489.2.32 loncom/lond:1.489.2.33
--- loncom/lond:1.489.2.32	Thu Aug  1 18:17:02 2019
+++ loncom/lond	Thu Aug 22 14:51:51 2019
@@ -2,7 +2,7 @@
 # The LearningOnline Network
 # lond "LON Daemon" Server (port "LOND" 5663)
 #
-# $Id: lond,v 1.489.2.32 2019/08/01 18:17:02 raeburn Exp $
+# $Id: lond,v 1.489.2.33 2019/08/22 14:51:51 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -63,7 +63,7 @@
 my $status='';
 my $lastlog='';
 
-my $VERSION='$Revision: 1.489.2.32 $'; #' stupid emacs
+my $VERSION='$Revision: 1.489.2.33 $'; #' stupid emacs
 my $remoteVERSION;
 my $currenthostid="default";
 my $currentdomainid;
@@ -2107,12 +2107,84 @@
     }
     if($validated) {
 	my $realpasswd  = &get_auth_type($udom, $uname); # Defined since authd.
-	
 	my ($howpwd,$contentpwd)=split(/:/,$realpasswd);
+        my $notunique;
 	if ($howpwd eq 'internal') {
 	    &Debug("internal auth");
             my $ncpass = &hash_passwd($udom,$npass);
-	    if(&rewrite_password_file($udom, $uname, "internal:$ncpass")) {
+            my (undef,$method, at rest) = split(/!/,$contentpwd);
+            if ($method eq 'bcrypt') {
+                my %passwdconf = &Apache::lonnet::get_passwdconf($udom);
+                if (($passwdconf{'numsaved'}) && ($passwdconf{'numsaved'} =~ /^\d+$/)) {
+                    my @oldpasswds;
+                    my $userpath = &propath($udom,$uname);
+                    my $fullpath = $userpath.'/oldpasswds';
+                    if (-d $userpath) {
+                        my @oldfiles;
+                        if (-e $fullpath) {
+                            if (opendir(my $dir,$fullpath)) {
+                                (@oldfiles) = grep(/^\d+$/,readdir($dir));
+                                closedir($dir);
+                            }
+                            if (@oldfiles) {
+                                @oldfiles = sort { $b <=> $a } (@oldfiles);
+                                my $numremoved = 0;
+                                for (my $i=0; $i<@oldfiles; $i++) {
+                                    if ($i>=$passwdconf{'numsaved'}) {
+                                        if (-f "$fullpath/$oldfiles[$i]") {
+                                            if (unlink("$fullpath/$oldfiles[$i]")) {
+                                                $numremoved ++;
+                                            }
+                                        }
+                                    } elsif (open(my $fh,'<',"$fullpath/$oldfiles[$i]")) {
+                                        while (my $line = <$fh>) {
+                                            push(@oldpasswds,$line);
+                                        }
+                                        close($fh);
+                                    }
+                                }
+                                if ($numremoved) {
+                                    &logthis("unlinked $numremoved old password files for $uname:$udom");
+                                }
+                            }
+                        }
+                        push(@oldpasswds,$contentpwd);
+                        foreach my $item (@oldpasswds) {
+                            my (undef,$method, at rest) = split(/!/,$item);
+                            if ($method eq 'bcrypt') {
+                                my $result = &hash_passwd($udom,$npass, at rest);
+                                if ($result eq $item) {
+                                    $notunique = 1;
+                                    last;
+                                }
+                            }
+                        }
+                        unless ($notunique) {
+                            unless (-e $fullpath) {
+                                if (&mkpath("$fullpath/")) {
+                                    chmod(0700,$fullpath);
+                                }
+                            }
+                            if (-d $fullpath) {
+                                my $now = time;
+                                if (open(my $fh,'>',"$fullpath/$now")) {
+                                    print $fh $contentpwd;
+                                    close($fh);
+                                    chmod(0400,"$fullpath/$now");
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            if ($notunique) {
+                my $msg="Result of password change for $uname:$udom - password matches one used before";
+                if ($lonhost) {
+                    $msg .= " - request originated from: $lonhost";
+                }
+                &logthis($msg);
+                &Reply($client, "prioruse\n", $userinput);
+	    } elsif (&rewrite_password_file($udom, $uname, "internal:$ncpass")) {
 		my $msg="Result of password change for $uname: pwchange_success";
                 if ($lonhost) {
                     $msg .= " - request originated from: $lonhost";
@@ -2140,7 +2212,6 @@
 	    #
 	    &Failure( $client, "auth_mode_error\n", $userinput);
 	}  
-	
     } else {
 	if ($failure eq '') {
 	    $failure = 'non_authorized';



From raeburn at source.lon-capa.org  Thu Aug 22 15:31:21 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Thu, 22 Aug 2019 19:31:21 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface
	lonuserutils.pm
Message-ID: <cvsraeburn1566502281@cvsserver>

raeburn		Thu Aug 22 19:31:21 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	lonuserutils.pm 
  Log:
  - For 2.11
    Backport 1.196, 1.197, 1.200
  
  
-------------- next part --------------
Index: loncom/interface/lonuserutils.pm
diff -u loncom/interface/lonuserutils.pm:1.184.4.3 loncom/interface/lonuserutils.pm:1.184.4.4
--- loncom/interface/lonuserutils.pm:1.184.4.3	Fri Jul 26 18:37:16 2019
+++ loncom/interface/lonuserutils.pm	Thu Aug 22 19:31:20 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Utility functions for managing LON-CAPA user accounts
 #
-# $Id: lonuserutils.pm,v 1.184.4.3 2019/07/26 18:37:16 raeburn Exp $
+# $Id: lonuserutils.pm,v 1.184.4.4 2019/08/22 19:31:20 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -438,7 +438,7 @@
             } elsif ($context eq 'domain') {
                 $setsection_call = 'setCourse()';
                 $setsections_js = &dc_setcourse_js($param{'formname'},$mode,
-                                                   $context,$showcredits);
+                                                   $context,$showcredits,$domain);
             }
             $finish = "  var checkSec = $setsection_call\n".
                       "  if (checkSec == 'ok') {\n".
@@ -531,20 +531,24 @@
 /* regexp here to check for non \d \. in credits */
 END
     } else {
+        my ($numrules,$intargjs) =
+            &passwd_validation_js('vf.elements[current.argfield].value',$domain);
         $auth_checks .= (<<END);
     foundatype=1;
     if (current.argfield == null || current.argfield == '') {
+        // The login radiobutton checked does not have an associated textbox
+    } else if (vf.elements[current.argfield].value == '') {
         var alertmsg = '';
         switch (current.radiovalue) {
             case 'krb':
                 alertmsg = '$alert{'krb'}';
                 break;
             case 'loc':
-            case 'fsys':
+            case 'int':
                 alertmsg = '$alert{'ipass'}';
                 break;
             case 'fsys':
-                alertmsg = '';
+                alertmsg = '$alert{'ipass'}';
                 break;
             default:
                 alertmsg = '';
@@ -553,6 +557,10 @@
             alert(alertmsg);
             return;
         }
+    } else if (current.radiovalue == 'int') {
+        if ($numrules > 0) {
+$intargjs
+        }
     }
 END
     }
@@ -641,6 +649,136 @@
                  $section_checks.$authheader;
     return $result;
 }
+
+sub passwd_validation_js {
+    my ($currpasswdval,$domain) = @_;
+    my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
+    my ($min,$max, at chars,$numrules,$intargjs,%alert);
+    $numrules = 0;
+    if (ref($passwdconf{'chars'}) eq 'ARRAY') {
+        if ($passwdconf{'min'} =~ /^\d+$/) {
+            $min = $passwdconf{'min'};
+            $numrules ++;
+        }
+        if ($passwdconf{'max'} =~ /^\d+$/) {
+            $max = $passwdconf{'max'};
+            $numrules ++;
+        }
+        @chars = @{$passwdconf{'chars'}};
+        if (@chars) {
+            $numrules ++;
+        }
+    } else {
+        $min = 7;
+        $numrules ++;
+    }
+    if (($min ne '') || ($max ne '') || (@chars > 0)) {
+        my $alertmsg = &mt('Initial password did not satisfy requirement(s):').'\n\n';
+        if ($min) {
+            $alert{'min'} = &mt('minimum [quant,_1,character]',$min).'\n';
+        }
+        if ($max) {
+            $alert{'max'} = &mt('maximum [quant,_1,character]',$max).'\n';
+        }
+        my (@charalerts, at charrules);
+        if (@chars) {
+            if (grep(/^uc$/, at chars)) {
+                push(@charalerts,&mt('contain at least one upper case letter'));
+                push(@charrules,'uc');
+            }
+            if (grep(/^lc$/, at chars)) {
+                push(@charalerts,&mt('contain at least one lower case letter'));
+                push(@charrules,'lc');
+            }
+            if (grep(/^num$/, at chars)) {
+                push(@charalerts,&mt('contain at least one number'));
+                push(@charrules,'num');
+            }
+            if (grep(/^spec$/, at chars)) {
+                push(@charalerts,&mt('contain at least one non-alphanumeric'));
+                push(@charrules,'spec');
+            }
+        }
+        $intargjs = qq|            var rulesmsg = '';\n|.
+                    qq|            var currpwval = $currpasswdval;\n|;
+            if ($min) {
+                $intargjs .= qq|
+            if (currpwval.length < $min) {
+                rulesmsg += ' - $alert{min}';
+            }
+|;
+            }
+            if ($max) {
+                $intargjs .= qq|
+            if (currpwval.length > $max) {
+                rulesmsg += ' - $alert{max}';
+            }
+|;
+            }
+            if (@chars > 0) {
+                my $charrulestr = '"'.join('","', at charrules).'"';
+                my $charalertstr = '"'.join('","', at charalerts).'"';
+                $intargjs .= qq|            var brokerules = new Array();\n|.
+                             qq|            var charrules = new Array($charrulestr);\n|.
+                             qq|            var charalerts = new Array($charalertstr);\n|;
+                my %rules;
+                map { $rules{$_} = 1; } @chars;
+                if ($rules{'uc'}) {
+                    $intargjs .= qq|
+            var ucRegExp = /[A-Z]/;
+            if (!ucRegExp.test(currpwval)) {
+                brokerules.push('uc');
+            }
+|;
+                }
+                if ($rules{'lc'}) {
+                    $intargjs .= qq|
+            var lcRegExp = /[a-z]/;
+            if (!lcRegExp.test(currpwval)) {
+                brokerules.push('lc');
+            }
+|;
+                }
+                if ($rules{'num'}) {
+                     $intargjs .= qq|
+            var numRegExp = /[0-9]/;
+            if (!numRegExp.test(currpwval)) {
+                brokerules.push('num');
+            }
+|;
+                }
+                if ($rules{'spec'}) {
+                     $intargjs .= q|
+            var specRegExp = /[!"#$%&'()*+,\-.\/:;<=>?@[\\^\]_`{\|}~]/;
+            if (!specRegExp.test(currpwval)) {
+                brokerules.push('spec');
+            }
+|;
+                }
+                $intargjs .= qq|
+            if (brokerules.length > 0) {
+                for (var i=0; i<brokerules.length; i++) {
+                    for (var j=0; j<charrules.length; j++) {
+                        if (brokerules[i] == charrules[j]) {
+                            rulesmsg += ' - '+charalerts[j]+'\\n';
+                            break;
+                        }
+                    }
+                }
+            }
+|;
+            }
+            $intargjs .= qq|
+            if (rulesmsg != '') {
+                rulesmsg = '$alertmsg'+rulesmsg;
+                alert(rulesmsg);
+                return false;
+            }
+|;
+    }
+    return ($numrules,$intargjs);
+}
+
 ###############################################################
 ###############################################################
 sub upload_manager_javascript_forward_associate {
@@ -4190,6 +4328,7 @@
     }
     my $amode  = '';
     my $genpwd = '';
+    my @genpwdfail;
     if ($env{'form.login'} eq 'krb') {
         $amode='krb';
         $amode.=$env{'form.krbver'};
@@ -4198,6 +4337,8 @@
         $amode='internal';
         if ((defined($env{'form.intarg'})) && ($env{'form.intarg'})) {
             $genpwd=$env{'form.intarg'};
+            @genpwdfail =
+                &Apache::loncommon::check_passwd_rules($domain,$genpwd);
         }
     } elsif ($env{'form.login'} eq 'loc') {
         $amode='localauth';
@@ -4276,7 +4417,6 @@
                                                   \@statuses,\@poss_roles);
                 &gather_userinfo($context,'view',\%userlist,$indexhash,\%info,
                              \%cstr_roles,$permission);
-
             }
         }
     }
@@ -4354,7 +4494,8 @@
         my $newuserdom = $env{'request.role.domain'};
         map { $cancreate{$_} = &can_create_user($newuserdom,$context,$_); } keys(%longtypes);
         # Get new users list
-        my (%existinguser,%userinfo,%disallow,%rulematch,%inst_results,%alerts,%checkuname);
+        my (%existinguser,%userinfo,%disallow,%rulematch,%inst_results,%alerts,%checkuname,
+            %showpasswdrules,$haspasswdmap);
         my $counter = -1;
         foreach my $line (@userdata) {
             $counter ++;
@@ -4482,12 +4623,44 @@
                         }
                     }
                     # determine user password
-                    my $password = $genpwd;
+                    my $password;
+                    my $passwdfromfile;
                     if (defined($fields{'ipwd'})) {
                         if ($entries{$fields{'ipwd'}}) {
                             $password=$entries{$fields{'ipwd'}};
+                            $passwdfromfile = 1;
+                            if ($env{'form.login'} eq 'int') {
+                                my $uhome=&Apache::lonnet::homeserver($username,$userdomain);
+                                if (($uhome eq 'no_host') || ($changeauth)) {
+                                    my @brokepwdrules =
+                                        &Apache::loncommon::check_passwd_rules($domain,$password);
+                                    if (@brokepwdrules) {
+                                        $disallow{$counter} = &mt('[_1]: Password included in file for this user did not meet requirements.',
+                                                                  '<b>'.$username.'</b>');
+                                        map { $showpasswdrules{$_} = 1; } @brokepwdrules;
+                                        next;
+                                    }
+                                }
+                            }
                         }
                     }
+                    unless ($passwdfromfile) {
+                        if ($env{'form.login'} eq 'int') {
+                            if (@genpwdfail) {
+                                my $uhome=&Apache::lonnet::homeserver($username,$userdomain);
+                                if (($uhome eq 'no_host') || ($changeauth)) {
+                                    $disallow{$counter} = &mt('[_1]: No specific password in file for this user; default password did not meet requirements',
+                                                              '<b>'.$username.'</b>');
+                                    unless ($haspasswdmap) {
+                                        map { $showpasswdrules{$_} = 1; } @genpwdfail;
+                                        $haspasswdmap = 1;
+                                    }
+                                }
+                                next;
+                            }
+                        }
+                        $password = $genpwd;
+                    }
                     # determine user role
                     my $role = '';
                     if (defined($fields{'role'})) {
@@ -4849,6 +5022,7 @@
                           $counts{'auth'})."</p>\n");
         }
         $r->print(&print_namespacing_alerts($domain,\%alerts,\%curr_rules));
+        $r->print(&passwdrule_alerts($domain,\%showpasswdrules));
         #####################################
         # Display list of students to drop  #
         #####################################
@@ -4918,6 +5092,38 @@
     }
 }
 
+sub passwdrule_alerts {
+    my ($domain,$passwdrules) = @_;
+    my $warning;
+    if (ref($passwdrules) eq 'HASH') {
+        my %showrules = %{$passwdrules};
+        if (keys(%showrules)) {
+            my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
+            $warning = '<b>'.&mt('Password requirement(s) unmet for one or more users:').'</b><ul>';
+            if ($showrules{'min'}) {
+                $warning .= '<li>'.&mt('minimum [quant,_1,character]',$passwdconf{'min'}).'</li>';
+            }
+            if ($showrules{'max'}) {
+                $warning .= '<li>'.&mt('maximum [quant,_1,character]',$passwdconf{'max'}).'</li>';
+            }
+            if ($showrules{'uc'}) {
+                $warning .= '<li>'.&mt('contain at least one upper case letter').'</li>';
+            }
+            if ($showrules{'lc'}) {
+                $warning .= '<li>'.&mt('contain at least one lower case letter').'</li>';
+            }
+            if ($showrules{'num'}) {
+                $warning .= '<li>'.&mt('contain at least one number').'</li>';
+            }
+            if ($showrules{'spec'}) {
+                $warning .= '<li>'.&mt('contain at least one non-alphanumeric').'</li>';
+            }
+            $warning .= '</ul>';
+        }
+    }
+    return $warning;
+}
+
 sub user_change_result {
     my ($r,$userresult,$authresult,$roleresult,$idresult,$counts,$flushc,
         $username,$userdomain,$userchg) = @_;
@@ -5999,7 +6205,7 @@
 }
 
 sub dc_setcourse_js {
-    my ($formname,$mode,$context,$showcredits) = @_;
+    my ($formname,$mode,$context,$showcredits,$domain) = @_;
     my ($dc_setcourse_code,$authen_check);
     my $cctext = &Apache::lonnet::plaintext('cc');
     my $cotext = &Apache::lonnet::plaintext('co');
@@ -6008,7 +6214,7 @@
     if ($mode eq 'upload') {
         $role = 'courserole';
     } else {
-        $authen_check = &verify_authen($formname,$context);
+        $authen_check = &verify_authen($formname,$context,$domain);
     }
     $dc_setcourse_code = (<<"SCRIPTTOP");
 $authen_check
@@ -6152,12 +6358,14 @@
 }
 
 sub verify_authen {
-    my ($formname,$context) = @_;
+    my ($formname,$context,$domain) = @_;
     my %alerts = &authcheck_alerts();
     my $finish = "return 'ok';";
     if ($context eq 'author') {
         $finish = "document.$formname.submit();";
     }
+    my ($numrules,$intargjs) =
+        &passwd_validation_js('argpicked',$domain);
     my $outcome = <<"ENDSCRIPT";
 
 function auth_check() {
@@ -6191,6 +6399,7 @@
                 break;
             case 'int':
                 alertmsg = '$alerts{'ipass'}';
+                break;
             case 'fsys':
                 alertmsg = '$alerts{'ipass'}';
                 break;
@@ -6204,6 +6413,11 @@
             alert(alertmsg);
             return;
         }
+    } else if (logintype == 'int') {
+        var numrules = $numrules;
+        if (numrules > 0) {
+$intargjs
+        }
     }
     $finish
 }

From raeburn at source.lon-capa.org  Sat Aug 24 22:43:34 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Sun, 25 Aug 2019 02:43:34 -0000
Subject: [LON-CAPA-cvs] cvs: loncom / LONCAPA.pm /enrollment Enrollment.pm
	/interface createaccount.pm domainprefs.pm loncommon.pm
	lonuserutils.pm /lonnet/perl lonnet.pm
Message-ID: <cvsraeburn1566701014@cvsserver>

raeburn		Sun Aug 25 02:43:34 2019 EDT

  Modified files:              
    /loncom/interface	domainprefs.pm createaccount.pm loncommon.pm 
                     	lonuserutils.pm 
    /loncom/enrollment	Enrollment.pm 
    /loncom/lonnet/perl	lonnet.pm 
    /loncom	LONCAPA.pm 
  Log:
  - Domain Configuration for passwords for internally-authenticated users.
    - Default minimum password length of 7 set in a single location.
    - Value for min length set in domain's configuration may not be less than
      the default.
    - javascript function:  warnIntPass() warns aboit invalid values for
      min and max length, expiration time, and number saved for domain
      config for passwords.  
  
  
-------------- next part --------------
Index: loncom/interface/domainprefs.pm
diff -u loncom/interface/domainprefs.pm:1.364 loncom/interface/domainprefs.pm:1.365
--- loncom/interface/domainprefs.pm:1.364	Tue Jul 23 01:30:35 2019
+++ loncom/interface/domainprefs.pm	Sun Aug 25 02:42:55 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.364 2019/07/23 01:30:35 raeburn Exp $
+# $Id: domainprefs.pm,v 1.365 2019/08/25 02:42:55 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -6256,6 +6256,7 @@
         }
     } elsif ($position eq 'lower') {
         my ($min,$max,%chars,$expire,$numsaved);
+        $min = $Apache::lonnet::passwdmin;
         if (ref($settings) eq 'HASH') {
             if ($settings->{min}) {
                 $min = $settings->{min};
@@ -6272,8 +6273,6 @@
             if ($settings->{numsaved}) {
                 $numsaved = $settings->{numsaved};
             }
-        } else {
-            $min = '7';
         }
         my %rulenames = &Apache::lonlocal::texthash(
                                                      uc => 'At least one upper case letter',
@@ -6284,14 +6283,16 @@
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
                       '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no minimum)').'</span>'.
+                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" '.
+                      'onblur="javascript:warnIntPass(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
                       '</span></td></tr>';
         $itemcount ++;
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
                       '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" />'.
+                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" '.
+                      'onblur="javascript:warnIntPass(this);" />'.
                       '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
                       '</span></td></tr>';
         $itemcount ++;
@@ -6331,7 +6332,8 @@
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'><td>'.$titles{'expire'}.'</td>'.
                       '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_expire" value="'.$expire.'" size="4" />'.
+                      '<input type="text" name="passwords_expire" value="'.$expire.'" size="4" '.
+                      'onblur="javascript:warnIntPass(this);" />'.
                       '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no expiration)').'</span>'.
                       '</span></td></tr>';
         $itemcount ++;
@@ -9295,16 +9297,22 @@
 }
 
 sub passwords_javascript {
-    my $intauthcheck = &mt('Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.');
-    my $intauthcost = &mt('Warning: bcrypt encryption cost for internal authentication must be an integer.');
-    &js_escape(\$intauthcheck);
-    &js_escape(\$intauthcost);
+    my %intalert = &Apache::lonlocal::texthash (
+        authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
+        authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
+        passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
+        passmax => 'Warning: maximum password length must be a positive integer (or blank).',
+        passexp => 'Warning: days before password expiration must be a positive integer (or blank).',
+        passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
+    );
+    &js_escape(\%intalert);
+    my $defmin = $Apache::lonnet::passwdmin;
     my $intauthjs = <<"ENDSCRIPT";
 
 function warnIntAuth(field) {
     if (field.name == 'intauth_check') {
         if (field.value == '2') {
-            alert('$intauthcheck');
+            alert('$intalert{authcheck}');
         }
     }
     if (field.name == 'intauth_cost') {
@@ -9312,7 +9320,60 @@
         if (field.value != '') {
             var regexdigit=/^\\d+\$/;
             if (!regexdigit.test(field.value)) {
-                alert('$intauthcost');
+                alert('$intalert{authcost}');
+            }
+        }
+    }
+    return;
+}
+
+function warnIntPass(field) {
+    field.value.replace(/^\s+/,'');
+    field.value.replace(/\s+\$/,'');
+    var regexdigit=/^\\d+\$/;
+    if (field.name == 'passwords_min') {
+        if (field.value == '') {
+            alert('$intalert{passmin}');
+            field.value = '$defmin';
+        } else {
+            if (!regexdigit.test(field.value)) {
+                alert('$intalert{passmin}');
+                field.value = '$defmin';
+            }
+            var minval = parseFloat(field.value,10);
+            if (minval < $defmin) {
+                alert('$intalert{passmin}');
+                field.value = '$defmin';
+            }
+        }
+    } else {
+        if (field.value == '0') {
+            field.value = '';
+        }
+        if (field.value != '') {
+            if (field.name == 'passwords_expire') {
+                var regexpposnum=/^\\d+(|\\.\\d*)\$/; 
+                if (!regexpposnum.test(field.value)) {
+                    alert('$intalert{passexp}');
+                    field.value = '';
+                } else {
+                    var expval = parseFloat(field.value);
+                    if (expval == 0) {
+                        alert('$intalert{passexp}');
+                        field.value = '';
+                    }
+                }
+            } else {
+                if (!regexdigit.test(field.value)) {
+                    if (field.name == 'passwords_max') {
+                        alert('$intalert{passmax}');
+                    } else {
+                        if (field.name == 'passwords_numsaved') {
+                            alert('$intalert{passnum}');
+                        }
+                    }
+                }
+                field.value = '';
             }
         }
     }
@@ -14490,8 +14551,8 @@
         'intauth_cost'   => 10,
         'intauth_check'  => 0,
         'intauth_switch' => 0,
-        'min'            => 7,
     );
+    $staticdefaults{'min'} = $Apache::lonnet::passwdmin;
     foreach my $type (@oktypes) {
         $staticdefaults{'resetpostlink'}{$type} = ['email','username'];
     }
@@ -14672,10 +14733,18 @@
         $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
         my $ruleok;
         if ($rule eq 'expire') {
-            if ($env{'form.passwords_'.$rule} =~ /^\d+(|\.\d*)$/) {
+            if (($env{'form.passwords_'.$rule} =~ /^\d+(|\.\d*)$/) &&
+                ($env{'form.passwords_'.$rule} ne '0')) {
                 $ruleok = 1;
             }
-        } elsif ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
+        } elsif ($rule eq 'min') {
+            if ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
+                if ($env{'form.passwords_'.$rule} >= $Apache::lonnet::passwdmin) {
+                    $ruleok = 1;
+                }
+            }
+        } elsif (($env{'form.passwords_'.$rule} =~ /^\d+$/) &&
+                 ($env{'form.passwords_'.$rule} ne '0')) {
             $ruleok = 1;
         }
         if ($ruleok) {
@@ -14885,7 +14954,8 @@
                             if ($confighash{'passwords'}{$rule} eq '') {
                                 if ($rule eq 'min') {
                                     $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
-                                                   ' '.&mt('Default of 7 will be used').'</li>';
+                                                   ' '.&mt('Default of [_1] will be used',
+                                                           $Apache::lonnet::passwdmin).'</li>';
                                 } else {
                                     $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
                                 }
Index: loncom/interface/createaccount.pm
diff -u loncom/interface/createaccount.pm:1.78 loncom/interface/createaccount.pm:1.79
--- loncom/interface/createaccount.pm:1.78	Sun May  5 23:19:47 2019
+++ loncom/interface/createaccount.pm	Sun Aug 25 02:42:56 2019
@@ -4,7 +4,7 @@
 # kerberos, or SSO) or an e-mail address. Requests to use an e-mail address as
 # username may be processed automatically, or may be queued for approval.
 #
-# $Id: createaccount.pm,v 1.78 2019/05/05 23:19:47 raeburn Exp $
+# $Id: createaccount.pm,v 1.79 2019/08/25 02:42:56 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -933,30 +933,30 @@
 # Check if the password entered by the user satisfies domain's requirements
         my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
         my ($min,$max, at chars);
+        $min = $Apache::lonnet::passwdmin;
         if (ref($passwdconf{'chars'}) eq 'ARRAY') {
             if ($passwdconf{'min'} =~ /^\d+$/) {
-                $min = $passwdconf{'min'};
+                if ($passwdconf{'min'} > $min) {
+                    $min = $passwdconf{'min'};
+                }
             }
             if ($passwdconf{'max'} =~ /^\d+$/) {
                 $max = $passwdconf{'max'};
             }
             @chars = @{$passwdconf{'chars'}};
-        } else {
-            $min = 7;
         }
-        if (($min ne '') || ($max ne '') || (@chars > 0)) {
-            my ($plainpass,$encpass);
-            my $encpass = $env{'form.upass'};
-            if ($encpass eq '') {
-                $msg = &mt('Password retrieved was blank.').
-                       '<br /><p>'.&mt('[_1]Return[_2] to the previous page to try again.',
-                                       '<a href="javascript:document.retryemail.submit();">','</a>');
-                $earlyout = 1;
-            } else {
+        my $encpass = $env{'form.upass'};
+        if ($encpass eq '') {
+            $msg = &mt('Password retrieved was blank.').
+                   '<br /><p>'.&mt('[_1]Return[_2] to the previous page to try again.',
+                                   '<a href="javascript:document.retryemail.submit();">','</a>');
+            $earlyout = 1;
+        } else {
 # Split the logtoken to retrieve the DES key and decrypt the encypted password
-                my ($key,$caller)=split(/&/,$tmpinfo);
-                if ($caller eq 'createaccount') {
-                    $plainpass = &Apache::loncommon::des_decrypt($key,$encpass);
+            my ($key,$caller)=split(/&/,$tmpinfo);
+            if ($caller eq 'createaccount') {
+                my $plainpass = &Apache::loncommon::des_decrypt($key,$encpass);
+                if (($min > 0) || ($max ne '') || (@chars > 0)) {
                     my $warning = &Apache::loncommon::check_passwd_rules($domain,$plainpass);
                     if ($warning) {
                         $msg = $warning.
Index: loncom/interface/loncommon.pm
diff -u loncom/interface/loncommon.pm:1.1332 loncom/interface/loncommon.pm:1.1333
--- loncom/interface/loncommon.pm:1.1332	Sat May 11 21:34:01 2019
+++ loncom/interface/loncommon.pm	Sun Aug 25 02:42:56 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common routines
 #
-# $Id: loncommon.pm,v 1.1332 2019/05/11 21:34:01 raeburn Exp $
+# $Id: loncommon.pm,v 1.1333 2019/08/25 02:42:56 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -3571,16 +3571,17 @@
     my ($domain,$plainpass) = @_;
     my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
     my ($min,$max, at chars, at brokerule,$warning);
+    $min = $Apache::lonnet::passwdmin;
     if (ref($passwdconf{'chars'}) eq 'ARRAY') {
         if ($passwdconf{'min'} =~ /^\d+$/) {
-            $min = $passwdconf{'min'};
+            if ($passwdconf{'min'} > $min) {
+                $min = $passwdconf{'min'};
+            }
         }
         if ($passwdconf{'max'} =~ /^\d+$/) {
             $max = $passwdconf{'max'};
         }
         @chars = @{$passwdconf{'chars'}};
-    } else {
-        $min = 7;
     }
     if (($min) && (length($plainpass) < $min)) {
         push(@brokerule,'min');
Index: loncom/interface/lonuserutils.pm
diff -u loncom/interface/lonuserutils.pm:1.201 loncom/interface/lonuserutils.pm:1.202
--- loncom/interface/lonuserutils.pm:1.201	Tue Jul 23 13:58:53 2019
+++ loncom/interface/lonuserutils.pm	Sun Aug 25 02:42:56 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Utility functions for managing LON-CAPA user accounts
 #
-# $Id: lonuserutils.pm,v 1.201 2019/07/23 13:58:53 raeburn Exp $
+# $Id: lonuserutils.pm,v 1.202 2019/08/25 02:42:56 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -656,9 +656,14 @@
     my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
     my ($min,$max, at chars,$numrules,$intargjs,%alert);
     $numrules = 0;
+    $min = $Apache::lonnet::passwdmin;
     if (ref($passwdconf{'chars'}) eq 'ARRAY') {
         if ($passwdconf{'min'} =~ /^\d+$/) {
-            $min = $passwdconf{'min'};
+            if ($passwdconf{'min'} > $min) {
+                $min = $passwdconf{'min'};
+                $numrules ++;
+            }
+        } else {
             $numrules ++;
         }
         if ($passwdconf{'max'} =~ /^\d+$/) {
@@ -670,10 +675,9 @@
             $numrules ++;
         }
     } else {
-        $min = 7;
         $numrules ++;
     }
-    if (($min ne '') || ($max ne '') || (@chars > 0)) {
+    if (($min > 0) || ($max ne '') || (@chars > 0)) {
         my $alertmsg = &mt('Initial password did not satisfy requirement(s):').'\n\n';
         if ($min) {
             $alert{'min'} = &mt('minimum [quant,_1,character]',$min).'\n';
@@ -4387,7 +4391,7 @@
         if ((defined($env{'form.intarg'})) && ($env{'form.intarg'})) {
             $genpwd=$env{'form.intarg'};
             @genpwdfail =
-                &Apache::loncommon::check_passwd_rules($domain,$genpwd); 
+                &Apache::loncommon::check_passwd_rules($domain,$genpwd);
         }
     } elsif ($env{'form.login'} eq 'loc') {
         $amode='localauth';
Index: loncom/enrollment/Enrollment.pm
diff -u loncom/enrollment/Enrollment.pm:1.53 loncom/enrollment/Enrollment.pm:1.54
--- loncom/enrollment/Enrollment.pm:1.53	Tue May 14 13:39:18 2019
+++ loncom/enrollment/Enrollment.pm	Sun Aug 25 02:43:09 2019
@@ -1,5 +1,5 @@
 # Automated Enrollment manager
-# $Id: Enrollment.pm,v 1.53 2019/05/14 13:39:18 raeburn Exp $
+# $Id: Enrollment.pm,v 1.54 2019/08/25 02:43:09 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -955,9 +955,12 @@
     my ($udom) = @_;
     my %passwdconf = &Apache::lonnet::get_passwdconf($udom);
     my ($min,$max, at chars);
+    $min = $Apache::lonnet::passwdmin;
     if (ref($passwdconf{'chars'}) eq 'ARRAY') {
         if ($passwdconf{'min'} =~ /^\d+$/) {
-            $min = $passwdconf{'min'};
+            if ($passwdconf{'min'} > $min) {
+                $min = $passwdconf{'min'};
+            }
         }
         if ($passwdconf{'max'} =~ /^\d+$/) {
             $max = $passwdconf{'max'};
Index: loncom/lonnet/perl/lonnet.pm
diff -u loncom/lonnet/perl/lonnet.pm:1.1415 loncom/lonnet/perl/lonnet.pm:1.1416
--- loncom/lonnet/perl/lonnet.pm:1.1415	Tue Aug 20 03:46:09 2019
+++ loncom/lonnet/perl/lonnet.pm	Sun Aug 25 02:43:21 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # TCP networking package
 #
-# $Id: lonnet.pm,v 1.1415 2019/08/20 03:46:09 raeburn Exp $
+# $Id: lonnet.pm,v 1.1416 2019/08/25 02:43:21 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -79,7 +79,7 @@
 
 use vars qw(%perlvar %spareid %pr %prp $memcache %packagetab $tmpdir $deftex
             $_64bit %env %protocol %loncaparevs %serverhomeIDs %needsrelease
-            %managerstab);
+            %managerstab $passwdmin);
 
 my (%badServerCache, $memcache, %courselogs, %accesshash, %domainrolehash,
     %userrolehash, $processmarker, $dumpcount, %coursedombuf,
@@ -15003,6 +15003,11 @@
     $deftex = LONCAPA::texengine();
 }
 
+# ------------- set default minimum length for passwords for internal auth users
+{
+    $passwdmin = LONCAPA::passwd_min();
+}
+
 $memcache=new Cache::Memcached({'servers'           => ['127.0.0.1:11211'],
 				'compress_threshold'=> 20_000,
  			        });
Index: loncom/LONCAPA.pm
diff -u loncom/LONCAPA.pm:1.35 loncom/LONCAPA.pm:1.36
--- loncom/LONCAPA.pm:1.35	Fri Feb 15 20:56:10 2019
+++ loncom/LONCAPA.pm	Sun Aug 25 02:43:33 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Base routines
 #
-# $Id: LONCAPA.pm,v 1.35 2019/02/15 20:56:10 raeburn Exp $
+# $Id: LONCAPA.pm,v 1.36 2019/08/25 02:43:33 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -156,6 +156,13 @@
     return $distro;
 }
 
+# Return the default password length. Can be overridden in a domain
+# by specifying a larger value (integer) in the domain configuration.
+
+sub passwd_min {
+    return 7;
+}
+
 #----------------------------------------------------------------------
 #
 #  some of these subs need a bit of documentation

From raeburn at source.lon-capa.org  Sun Aug 25 09:37:38 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Sun, 25 Aug 2019 13:37:38 -0000
Subject: [LON-CAPA-cvs] cvs: loncom /interface domainprefs.pm
Message-ID: <cvsraeburn1566740258@cvsserver>

raeburn		Sun Aug 25 13:37:38 2019 EDT

  Modified files:              
    /loncom/interface	domainprefs.pm 
  Log:
  - Minimum password length is an integer.
  
  
Index: loncom/interface/domainprefs.pm
diff -u loncom/interface/domainprefs.pm:1.365 loncom/interface/domainprefs.pm:1.366
--- loncom/interface/domainprefs.pm:1.365	Sun Aug 25 02:42:55 2019
+++ loncom/interface/domainprefs.pm	Sun Aug 25 13:37:37 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.365 2019/08/25 02:42:55 raeburn Exp $
+# $Id: domainprefs.pm,v 1.366 2019/08/25 13:37:37 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -9340,7 +9340,7 @@
                 alert('$intalert{passmin}');
                 field.value = '$defmin';
             }
-            var minval = parseFloat(field.value,10);
+            var minval = parseInt(field.value,10);
             if (minval < $defmin) {
                 alert('$intalert{passmin}');
                 field.value = '$defmin';



From raeburn at source.lon-capa.org  Sun Aug 25 09:55:56 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Sun, 25 Aug 2019 13:55:56 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface
	createaccount.pm
Message-ID: <cvsraeburn1566741356@cvsserver>

raeburn		Sun Aug 25 13:55:56 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	createaccount.pm 
  Log:
  - For 2.11
    Backport 1.77, 1.78, 1.79 
  
  
-------------- next part --------------
Index: loncom/interface/createaccount.pm
diff -u loncom/interface/createaccount.pm:1.72.4.2 loncom/interface/createaccount.pm:1.72.4.3
--- loncom/interface/createaccount.pm:1.72.4.2	Mon Jul 29 13:54:02 2019
+++ loncom/interface/createaccount.pm	Sun Aug 25 13:55:55 2019
@@ -4,7 +4,7 @@
 # kerberos, or SSO) or an e-mail address. Requests to use an e-mail address as
 # username may be processed automatically, or may be queued for approval.
 #
-# $Id: createaccount.pm,v 1.72.4.2 2019/07/29 13:54:02 raeburn Exp $
+# $Id: createaccount.pm,v 1.72.4.3 2019/08/25 13:55:55 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -37,6 +37,7 @@
 use Apache::lonnet;
 use Apache::loncommon;
 use Apache::lonhtmlcommon;
+use Apache::lonuserutils;
 use Apache::lonlocal;
 use Apache::lonauth;
 use Apache::resetpw;
@@ -520,10 +521,12 @@
 }
 
 sub javascript_checkpass {
-    my ($now,$context) = @_;
+    my ($now,$context,$domain) = @_;
     my $nopass = &mt('You must enter a password.');
     my $mismatchpass = &mt('The passwords you entered did not match.')."\n".
                        &mt('Please try again.'); 
+    my ($numrules,$intargjs) =
+        &Apache::lonuserutils::passwd_validation_js('upass',$domain);
     &js_escape(\$nopass);
     &js_escape(\$mismatchpass);
     my $js = <<"ENDSCRIPT";
@@ -540,6 +543,10 @@
                 return false;
             }
             if (upass == upasscheck) {
+                var numrules = $numrules;
+                if (numrules > 0) {
+$intargjs
+                }
                 client.elements.upasscheck$now.value='';
                 if (validate_email(client)) {
                     send(one,two,'$context');
@@ -835,8 +842,24 @@
             } else {
                 my ($captcha_chk,$captcha_error) = &Apache::loncommon::captcha_response('usercreation',$server);
                 if ($captcha_chk != 1) {
-                    $output = &invalid_state('captcha',$domdesc,$contact_name,
-                                             $contact_email,$captcha_error);
+                    $output = '<span class="LC_warning">'.
+                              &mt('Validation of the code you entered failed.').'</span>'.
+                              '<br />'.$captcha_error."\n".'<br /><p>'.
+                               &mt('[_1]Return[_2] to the previous page to try again.',
+                                   '<a href="javascript:document.retryemail.submit();">','</a>')."\n".
+                              '<form name="retryemail" action="/adm/createaccount" method="post" />'.
+                              '<input type="hidden" name="domain" value="'.$domain.'" />'."\n";
+                    if ($env{'form.courseid'} =~ /^$match_domain\_$match_courseid$/) {
+                        $output .= '<input type="hidden" name="courseid" value="'.$env{'form.courseid'}.'" />'."\n";
+                    }
+                    if ($env{'form.type'}) {
+                        my $usertype = &get_usertype($domain);
+                        if ($usertype ne '') {
+                            $output .= '<input type="hidden" name="type" value="'.$usertype.'" />'."\n".
+                                       '<input type="hidden" name="reportedtype" value="'.&mt('Submit').'" />'."\n";
+                        }
+                    }
+                    $output .= '</form></p>';
                     return $output;
                 }
                 my (%rulematch,%inst_results,%curr_rules,%got_rules,%alerts);
@@ -894,16 +917,72 @@
     $env{'form.logtoken'} =~ s/(`)//g;
     if ($env{'form.logtoken'}) {
         my $logtoken = $env{'form.logtoken'};
+        my $earlyout;
         my $tmpinfo=Apache::lonnet::reply('tmpget:'.$logtoken,$server);
         if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) {
             $msg = &mt('Information needed to process your request is missing, inaccessible or expired.')
-                  .'<br />'.&mt('Return to the previous page to try again.');
+                  .'<br /><p>'.&mt('[_1]Return[_2] to the previous page to try again.',
+                                   '<a href="javascript:document.retryemail.submit();">','</a>');
+            $earlyout = 1;
         } else {
             my $reply = &Apache::lonnet::reply('tmpdel:'.$logtoken,$server);
             unless ($reply eq 'ok') {
                 $msg .= &mt('Request could not be processed.');
             }
         }
+# Check if the password entered by the user satisfies domain's requirements
+        my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
+        my ($min,$max, at chars);
+        $min = $Apache::lonnet::passwdmin;
+        if (ref($passwdconf{'chars'}) eq 'ARRAY') {
+            if ($passwdconf{'min'} =~ /^\d+$/) {
+                if ($passwdconf{'min'} > $min) {
+                    $min = $passwdconf{'min'};
+                }
+            }
+            if ($passwdconf{'max'} =~ /^\d+$/) {
+                $max = $passwdconf{'max'};
+            }
+            @chars = @{$passwdconf{'chars'}};
+        }
+        my $encpass = $env{'form.upass'};
+        if ($encpass eq '') {
+            $msg = &mt('Password retrieved was blank.').
+                   '<br /><p>'.&mt('[_1]Return[_2] to the previous page to try again.',
+                                   '<a href="javascript:document.retryemail.submit();">','</a>');
+            $earlyout = 1;
+        } else {
+# Split the logtoken to retrieve the DES key and decrypt the encypted password
+            my ($key,$caller)=split(/&/,$tmpinfo);
+            if ($caller eq 'createaccount') {
+                my $plainpass = &Apache::loncommon::des_decrypt($key,$encpass);
+                if (($min > 0) || ($max ne '') || (@chars > 0)) {
+                    my $warning = &Apache::loncommon::check_passwd_rules($domain,$plainpass);
+                    if ($warning) {
+                        $msg = $warning.
+                               '<p>'.&mt('[_1]Return[_2] to the previous page to try again.',
+                                         '<a href="javascript:document.retryemail.submit();">','</a>');
+                        $earlyout = 1;
+                    }
+                }
+            }
+        }
+        if ($earlyout) {
+            $msg .= '<form name="retryemail" action="/adm/createaccount" method="post" />'.
+                    '<input type="hidden" name="domain" value="'.$domain.'" />'."\n";
+            if ($env{'form.courseid'} =~ /^$match_domain\_$match_courseid$/) {
+                $msg .= '<input type="hidden" name="courseid" value="'.$env{'form.courseid'}.'" />'."\n";
+            }
+            if ($env{'form.type'}) {
+                my $usertype = &get_usertype($domain);
+                if ($usertype ne '') {
+                    $msg .= '<input type="hidden" name="type" value="'.$usertype.'" />'.
+                            '<input type="hidden" name="reportedtype" value="'.&mt('Submit').'" />'."\n";
+                }
+            }
+            $msg .= '</form></p>';
+            return $msg;
+        }
         my %info = ('ip'         => $ENV{'REMOTE_ADDR'},
                     'time'       => $now,
                     'domain'     => $domain,
@@ -1096,7 +1175,7 @@
         close($jsh);
         $output = &javascript_setforms($now,$emailusername,$captcha,$usertype,$recaptchaversion,
                                        $usernameset,$condition,$excluded).
-                  "\n".&javascript_checkpass($now,'email');
+                  "\n".&javascript_checkpass($now,'email',$domain);
         my ($lkey,$ukey) = &Apache::loncommon::des_keys();
         my ($lextkey,$uextkey) = &getkeys($lkey,$ukey);
         my $logtoken=Apache::lonnet::reply('tmpput:'.$ukey.$lkey.'&createaccount:createaccount',
@@ -1704,8 +1783,6 @@
         $msg .= &mt('Username rules at this institution do not allow the e-mail address you provided to be used as a username.');
     } elsif ($error eq 'userformat') {
         $msg .= &mt('The e-mail address you provided may not be used as a username at this LON-CAPA institution.');
-    } elsif ($error eq 'captcha') {
-        $msg .= &mt('Validation of the code you entered failed.');
     } elsif ($error eq 'noemails') {
         $msg .= &mt('Creation of a new user account using an e-mail address as username is not permitted at this LON-CAPA institution.');
     } elsif ($error eq 'emailfail') {

From raeburn at source.lon-capa.org  Sun Aug 25 10:15:20 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Sun, 25 Aug 2019 14:15:20 -0000
Subject: [LON-CAPA-cvs] cvs: loncom /interface domainprefs.pm
Message-ID: <cvsraeburn1566742520@cvsserver>

raeburn		Sun Aug 25 14:15:20 2019 EDT

  Modified files:              
    /loncom/interface	domainprefs.pm 
  Log:
  - javascript function:  warnIntPass() warns about invalid value for
    number of previous passwords saved in domain config for passwords
  
  
Index: loncom/interface/domainprefs.pm
diff -u loncom/interface/domainprefs.pm:1.366 loncom/interface/domainprefs.pm:1.367
--- loncom/interface/domainprefs.pm:1.366	Sun Aug 25 13:37:37 2019
+++ loncom/interface/domainprefs.pm	Sun Aug 25 14:15:20 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.366 2019/08/25 13:37:37 raeburn Exp $
+# $Id: domainprefs.pm,v 1.367 2019/08/25 14:15:20 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -6340,7 +6340,8 @@
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
                       '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" />'.
+                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" '.
+                      'onblur="javascript:warnIntPass(this);" />'. 
                       '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
                       '</span></td></tr>';
     } else {



From raeburn at source.lon-capa.org  Sun Aug 25 10:35:24 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Sun, 25 Aug 2019 14:35:24 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface domainprefs.pm
Message-ID: <cvsraeburn1566743724@cvsserver>

raeburn		Sun Aug 25 14:35:24 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	domainprefs.pm 
  Log:
  - For 2.11
    Backport 1.365, 1.366, 1.367 (except password expiration parts).
  
  
-------------- next part --------------
Index: loncom/interface/domainprefs.pm
diff -u loncom/interface/domainprefs.pm:1.160.6.98 loncom/interface/domainprefs.pm:1.160.6.99
--- loncom/interface/domainprefs.pm:1.160.6.98	Wed Aug 21 20:31:37 2019
+++ loncom/interface/domainprefs.pm	Sun Aug 25 14:35:21 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.160.6.98 2019/08/21 20:31:37 raeburn Exp $
+# $Id: domainprefs.pm,v 1.160.6.99 2019/08/25 14:35:21 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -4341,6 +4341,7 @@
         }
     } elsif ($position eq 'lower') {
         my ($min,$max,%chars,$numsaved);
+        $min = $Apache::lonnet::passwdmin;
         if (ref($settings) eq 'HASH') {
             if ($settings->{min}) {
                 $min = $settings->{min};
@@ -4354,8 +4355,6 @@
             if ($settings->{numsaved}) {
                 $numsaved = $settings->{numsaved};
             }
-        } else {
-            $min = '7';
         }
         my %rulenames = &Apache::lonlocal::texthash(
                                                      uc => 'At least one upper case letter',
@@ -4366,14 +4365,16 @@
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
                       '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no minimum)').'</span>'.
+                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" '.
+                      'onblur="javascript:warnIntPass(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
                       '</span></td></tr>';
         $itemcount ++;
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
                       '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" />'.
+                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" '.
+                      'onblur="javascript:warnIntPass(this);" />'.
                       '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
                       '</span></td></tr>';
         $itemcount ++;
@@ -4413,7 +4414,8 @@
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
                       '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" />'.
+                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" .
+                      'onblur="javascript:warnIntPass(this);" />'.
                       '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
                       '</span></td></tr>';
     } else {
@@ -7135,16 +7137,22 @@
 }
 
 sub passwords_javascript {
-    my $intauthcheck = &mt('Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.');
-    my $intauthcost = &mt('Warning: bcrypt encryption cost for internal authentication must be an integer.');
-    &js_escape(\$intauthcheck);
-    &js_escape(\$intauthcost);
+    my %intalert = &Apache::lonlocal::texthash (
+        authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
+        authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
+        passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
+        passmax => 'Warning: maximum password length must be a positive integer (or blank).',
+        passexp => 'Warning: days before password expiration must be a positive integer (or blank).',
+        passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
+    );
+    &js_escape(\%intalert);
+    my $defmin = $Apache::lonnet::passwdmin;
     my $intauthjs = <<"ENDSCRIPT";
 
 function warnIntAuth(field) {
     if (field.name == 'intauth_check') {
         if (field.value == '2') {
-            alert('$intauthcheck');
+            alert('$intalert{authcheck}');
         }
     }
     if (field.name == 'intauth_cost') {
@@ -7152,7 +7160,60 @@
         if (field.value != '') {
             var regexdigit=/^\\d+\$/;
             if (!regexdigit.test(field.value)) {
-                alert('$intauthcost');
+                alert('$intalert{authcost}');
+            }
+        }
+    }
+    return;
+}
+
+function warnIntPass(field) {
+    field.value.replace(/^\s+/,'');
+    field.value.replace(/\s+\$/,'');
+    var regexdigit=/^\\d+\$/;
+    if (field.name == 'passwords_min') {
+        if (field.value == '') {
+            alert('$intalert{passmin}');
+            field.value = '$defmin';
+        } else {
+            if (!regexdigit.test(field.value)) {
+                alert('$intalert{passmin}');
+                field.value = '$defmin';
+            }
+            var minval = parseInt(field.value,10);
+            if (minval < $defmin) {
+                alert('$intalert{passmin}');
+                field.value = '$defmin';
+            }
+        }
+    } else {
+        if (field.value == '0') {
+            field.value = '';
+        }
+        if (field.value != '') {
+            if (field.name == 'passwords_expire') {
+                var regexpposnum=/^\\d+(|\\.\\d*)\$/;
+                if (!regexpposnum.test(field.value)) {
+                    alert('$intalert{passexp}');
+                    field.value = '';
+                } else {
+                    var expval = parseFloat(field.value);
+                    if (expval == 0) {
+                        alert('$intalert{passexp}');
+                        field.value = '';
+                    }
+                }
+            } else {
+                if (!regexdigit.test(field.value)) {
+                    if (field.name == 'passwords_max') {
+                        alert('$intalert{passmax}');
+                    } else {
+                        if (field.name == 'passwords_numsaved') {
+                            alert('$intalert{passnum}');
+                        }
+                    }
+                }
+                field.value = '';
             }
         }
     }
@@ -10575,8 +10636,8 @@
         'intauth_cost'   => 10,
         'intauth_check'  => 0,
         'intauth_switch' => 0,
-        'min'            => 7,
     );
+    $staticdefaults{'min'} = $Apache::lonnet::passwdmin;
     foreach my $type (@oktypes) {
         $staticdefaults{'resetpostlink'}{$type} = ['email','username'];
     }
@@ -10756,7 +10817,18 @@
     }
     foreach my $rule ('min','max','numsaved') {
         $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
-        if ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
+        my $ruleok;
+        if ($rule eq 'min') {
+            if ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
+                if ($env{'form.passwords_'.$rule} >= $Apache::lonnet::passwdmin) {
+                    $ruleok = 1;
+                }
+            }
+        } elsif (($env{'form.passwords_'.$rule} =~ /^\d+$/) &&
+                 ($env{'form.passwords_'.$rule} ne '0')) {
+            $ruleok = 1;
+        }
+        if ($ruleok) {
             $newvalues{$rule} = $env{'form.passwords_'.$rule};
             if (exists($current{$rule})) {
                 if ($newvalues{$rule} ne $current{$rule}) {
@@ -10963,7 +11035,8 @@
                             if ($confighash{'passwords'}{$rule} eq '') {
                                 if ($rule eq 'min') {
                                     $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
-                                                   ' '.&mt('Default of 7 will be used').'</li>';
+                                                   ' '.&mt('Default of [_1] will be used',
+                                                           $Apache::lonnet::passwdmin).'</li>';
                                 } else {
                                     $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
                                 }

From raeburn at source.lon-capa.org  Sun Aug 25 18:29:29 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Sun, 25 Aug 2019 22:29:29 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) / LONCAPA.pm
Message-ID: <cvsraeburn1566772169@cvsserver>

raeburn		Sun Aug 25 22:29:29 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom	LONCAPA.pm 
  Log:
  - For 2.11
    Backport 1.36
  
  
Index: loncom/LONCAPA.pm
diff -u loncom/LONCAPA.pm:1.35.2.1 loncom/LONCAPA.pm:1.35.2.2
--- loncom/LONCAPA.pm:1.35.2.1	Fri Feb 15 22:01:23 2019
+++ loncom/LONCAPA.pm	Sun Aug 25 22:29:29 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Base routines
 #
-# $Id: LONCAPA.pm,v 1.35.2.1 2019/02/15 22:01:23 raeburn Exp $
+# $Id: LONCAPA.pm,v 1.35.2.2 2019/08/25 22:29:29 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -156,6 +156,13 @@
     return $distro;
 }
 
+# Return the default password length. Can be overridden in a domain
+# by specifying a larger value (integer) in the domain configuration.
+
+sub passwd_min {
+    return 7;
+}
+
 #----------------------------------------------------------------------
 #
 #  some of these subs need a bit of documentation



From raeburn at source.lon-capa.org  Sun Aug 25 18:45:59 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Sun, 25 Aug 2019 22:45:59 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /lonnet/perl lonnet.pm
Message-ID: <cvsraeburn1566773159@cvsserver>

raeburn		Sun Aug 25 22:45:59 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/lonnet/perl	lonnet.pm 
  Log:
  - For 2.11
    Backport 1.1416
  
  
Index: loncom/lonnet/perl/lonnet.pm
diff -u loncom/lonnet/perl/lonnet.pm:1.1172.2.113 loncom/lonnet/perl/lonnet.pm:1.1172.2.114
--- loncom/lonnet/perl/lonnet.pm:1.1172.2.113	Thu Aug 22 00:16:39 2019
+++ loncom/lonnet/perl/lonnet.pm	Sun Aug 25 22:45:58 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # TCP networking package
 #
-# $Id: lonnet.pm,v 1.1172.2.113 2019/08/22 00:16:39 raeburn Exp $
+# $Id: lonnet.pm,v 1.1172.2.114 2019/08/25 22:45:58 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -78,7 +78,7 @@
 
 use vars qw(%perlvar %spareid %pr %prp $memcache %packagetab $tmpdir $deftex
             $_64bit %env %protocol %loncaparevs %serverhomeIDs %needsrelease
-            %managerstab);
+            %managerstab $passwdmin);
 
 my (%badServerCache, $memcache, %courselogs, %accesshash, %domainrolehash,
     %userrolehash, $processmarker, $dumpcount, %coursedombuf,
@@ -13935,6 +13935,11 @@
     $deftex = LONCAPA::texengine();
 }
 
+# ------------- set default minimum length for passwords for internal auth users
+{
+    $passwdmin = LONCAPA::passwd_min();
+}
+
 $memcache=new Cache::Memcached({'servers'           => ['127.0.0.1:11211'],
 				'compress_threshold'=> 20_000,
  			        });



From raeburn at source.lon-capa.org  Sun Aug 25 18:56:16 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Sun, 25 Aug 2019 22:56:16 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface loncommon.pm
Message-ID: <cvsraeburn1566773776@cvsserver>

raeburn		Sun Aug 25 22:56:16 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	loncommon.pm 
  Log:
  - For 2.11
    Backport 1.1333
  
  
Index: loncom/interface/loncommon.pm
diff -u loncom/interface/loncommon.pm:1.1075.2.137 loncom/interface/loncommon.pm:1.1075.2.138
--- loncom/interface/loncommon.pm:1.1075.2.137	Thu Aug 22 00:11:04 2019
+++ loncom/interface/loncommon.pm	Sun Aug 25 22:56:14 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common routines
 #
-# $Id: loncommon.pm,v 1.1075.2.137 2019/08/22 00:11:04 raeburn Exp $
+# $Id: loncommon.pm,v 1.1075.2.138 2019/08/25 22:56:14 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -3175,16 +3175,17 @@
     my ($domain,$plainpass) = @_;
     my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
     my ($min,$max, at chars, at brokerule,$warning);
+    $min = $Apache::lonnet::passwdmin;
     if (ref($passwdconf{'chars'}) eq 'ARRAY') {
         if ($passwdconf{'min'} =~ /^\d+$/) {
-            $min = $passwdconf{'min'};
+            if ($passwdconf{'min'} > $min) {
+                $min = $passwdconf{'min'};
+            }
         }
         if ($passwdconf{'max'} =~ /^\d+$/) {
             $max = $passwdconf{'max'};
         }
         @chars = @{$passwdconf{'chars'}};
-    } else {
-        $min = 7;
     }
     if (($min) && (length($plainpass) < $min)) {
         push(@brokerule,'min');



From raeburn at source.lon-capa.org  Sun Aug 25 20:15:58 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Mon, 26 Aug 2019 00:15:58 -0000
Subject: [LON-CAPA-cvs] cvs: loncom /interface lonuserutils.pm
Message-ID: <cvsraeburn1566778558@cvsserver>

raeburn		Mon Aug 26 00:15:58 2019 EDT

  Modified files:              
    /loncom/interface	lonuserutils.pm 
  Log:
  - Update $numrules in &passwd_validation_js() if minimum password length > 0
  
  
Index: loncom/interface/lonuserutils.pm
diff -u loncom/interface/lonuserutils.pm:1.202 loncom/interface/lonuserutils.pm:1.203
--- loncom/interface/lonuserutils.pm:1.202	Sun Aug 25 02:42:56 2019
+++ loncom/interface/lonuserutils.pm	Mon Aug 26 00:15:57 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Utility functions for managing LON-CAPA user accounts
 #
-# $Id: lonuserutils.pm,v 1.202 2019/08/25 02:42:56 raeburn Exp $
+# $Id: lonuserutils.pm,v 1.203 2019/08/26 00:15:57 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -661,10 +661,7 @@
         if ($passwdconf{'min'} =~ /^\d+$/) {
             if ($passwdconf{'min'} > $min) {
                 $min = $passwdconf{'min'};
-                $numrules ++;
             }
-        } else {
-            $numrules ++;
         }
         if ($passwdconf{'max'} =~ /^\d+$/) {
             $max = $passwdconf{'max'};
@@ -674,7 +671,8 @@
         if (@chars) {
             $numrules ++;
         }
-    } else {
+    }
+    if ($min > 0) {
         $numrules ++;
     }
     if (($min > 0) || ($max ne '') || (@chars > 0)) {



From raeburn at source.lon-capa.org  Sun Aug 25 21:28:52 2019
From: raeburn at source.lon-capa.org (raeburn)
Date: Mon, 26 Aug 2019 01:28:52 -0000
Subject: [LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface
	lonuserutils.pm
Message-ID: <cvsraeburn1566782932@cvsserver>

raeburn		Mon Aug 26 01:28:52 2019 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	lonuserutils.pm 
  Log:
  - For 2.11
    Backport 1.202, 1.203
  
  
Index: loncom/interface/lonuserutils.pm
diff -u loncom/interface/lonuserutils.pm:1.184.4.4 loncom/interface/lonuserutils.pm:1.184.4.5
--- loncom/interface/lonuserutils.pm:1.184.4.4	Thu Aug 22 19:31:20 2019
+++ loncom/interface/lonuserutils.pm	Mon Aug 26 01:28:51 2019
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Utility functions for managing LON-CAPA user accounts
 #
-# $Id: lonuserutils.pm,v 1.184.4.4 2019/08/22 19:31:20 raeburn Exp $
+# $Id: lonuserutils.pm,v 1.184.4.5 2019/08/26 01:28:51 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -655,10 +655,12 @@
     my %passwdconf = &Apache::lonnet::get_passwdconf($domain);
     my ($min,$max, at chars,$numrules,$intargjs,%alert);
     $numrules = 0;
+    $min = $Apache::lonnet::passwdmin;
     if (ref($passwdconf{'chars'}) eq 'ARRAY') {
         if ($passwdconf{'min'} =~ /^\d+$/) {
-            $min = $passwdconf{'min'};
-            $numrules ++;
+            if ($passwdconf{'min'} > $min) {
+                $min = $passwdconf{'min'};
+            }
         }
         if ($passwdconf{'max'} =~ /^\d+$/) {
             $max = $passwdconf{'max'};
@@ -668,11 +670,11 @@
         if (@chars) {
             $numrules ++;
         }
-    } else {
-        $min = 7;
+    }
+    if ($min > 0) {
         $numrules ++;
     }
-    if (($min ne '') || ($max ne '') || (@chars > 0)) {
+    if (($min > 0) || ($max ne '') || (@chars > 0)) {
         my $alertmsg = &mt('Initial password did not satisfy requirement(s):').'\n\n';
         if ($min) {
             $alert{'min'} = &mt('minimum [quant,_1,character]',$min).'\n';