Forbid username, domain, themed name as password

[Admin-Viatos]

Hello everyone,

yesterday I discovered a strange thing: it’s possible to use the Username as password (testet in NC17 and NC18). App "password policy" is active.

If your Username rules the password policy you can set the Username as password

Should that be so ???

[kesselb]

cc @nextcloud/security

Nextcloud is also accepting contributions ;) Code for password_policy is here: https://github.com/nextcloud/password_policy

[rullzer]

@Admin-Viatos ah you found my secret TODO list.

So yes. Currently this is allowed. But you are right that it probably should not be.
Same goes for the domain, and the themed name of the site etc. All of this should be blocked in my opinion (or at least be configured to be blocked).

As said by @kesselb if you have any php coding skills (or want to learn). See https://github.com/nextcloud/password_policy where we handle this :)

[georgehrke]

Moving to password_policy repository ...