Non-matching repeated passwords are allowed about huge

[panique]

I just checked this, and 1.) passwords are checked for being exactly the same in line 61, classes/Registration.php && ($_POST['user_password_new'] == $_POST['user_password_repeat']) and 2.) 0 and 00 are not even possible due to the empty()-checks some lines above. Please see the docs for php's empty function here: php.net/manual/en/function.empty.php

As this is false alarm, I will close this ticket.

[panique]

btw the unnecessary password_repeat property will be removed in the next days!

[minitech]

$_POST['user_password_new'] == $_POST['user_password_repeat'] isn’t “exactly equal” in PHP. I wasn’t aware that empty is that horrible in PHP as well, but there you go :)

It’s still an issue.

[panique]

I just had some research, and i must say that you are totally right with the ==. 0 and 00 would not be real case (as 0 is filtered out by empty()), but 0001 and 1 would be true. Interesting case! Never seen that in any of the login script i've worked through.

EDIT: Ah, I just saw your link that says exactly the same ;)

[panique]

This is an extremely weird egde case, but i agree, it's cleaner to do it like this. It's fixed and pushed.

[panique]

Btw BIG THANKS for your excellent support! This has improved some elements in the script quite much.