Yeah, something doesn't sound to be working quite as intended

We shouldn't be enforcing anything just yet as https://gerrit.wikimedia.org/r/#/c/operations/mediawiki-config/+/479570/ isn't publicised/deployed yet

I'm guessing this was your account in the "staff" global group?

Password length restrictions set by 'MinimalPasswordLength' already do display a password reset page. gerrit:479570 will just remove the "skip" button for privileged users.

But for the "staff" global group, rOMWC0aa1684076ce: Enforce a 10-byte password for staff users set 'MinimalPasswordLengthToLogin' to 10 which will prevent the login before it gets to the point of displaying the reset page. This is slightly more secure, as it prevents a dormant account with a too-short password from being compromised and the attacker being the one to reset the password.

In T214215#4894326, @Anomie wrote:

I'm guessing this was your account in the "staff" global group?

If so, this is invalid and can be made public

In T214215#4894170, @Reedy wrote:

We shouldn't be enforcing anything just yet as https://gerrit.wikimedia.org/r/#/c/operations/mediawiki-config/+/479570/ isn't publicised/deployed yet

Also it's going to force password change, not reset. (Same as the current nag screen except there won't be a Skip button.)

Yeah the message could be improved (although gerrit 479570 as written now will remove this check entirely). Also it does not prevent non-fatal errors from being displayed, which results in the weird duplication (since MinimalPasswordLength also runs and has the same message). Not sure if that's worth the effort though.

Change 485480 had a related patch set uploaded (by Gergő Tisza; owner: Gergő Tisza):
[mediawiki/core@master] Improve message for fatal password validity errors on login

https://gerrit.wikimedia.org/r/485480

In T214215#4894365, @Reedy wrote:

In T214215#4894326, @Anomie wrote:

I'm guessing this was your account in the "staff" global group?

If so, this is invalid and can be made public

It was my staff account. The error message threw me off. https://gerrit.wikimedia.org/r/485480 seems to address that

In T214215#4894705, @Tgr wrote:

In T214215#4894170, @Reedy wrote:

We shouldn't be enforcing anything just yet as https://gerrit.wikimedia.org/r/#/c/operations/mediawiki-config/+/479570/ isn't publicised/deployed yet

Also it's going to force password change, not reset. (Same as the current nag screen except there won't be a Skip button.)

Yeah the message could be improved (although gerrit 479570 as written now will remove this check entirely). Also it does not prevent non-fatal errors from being displayed, which results in the weird duplication (since MinimalPasswordLength also runs and has the same message). Not sure if that's worth the effort though.

Maybe it is not high priority but I would leave a ticket open somewhere to take care of the duplication.

FWIW I've tested https://gerrit.wikimedia.org/r/485480 and I get the two messages but apparently with different min lengths. It might be my local setup

In T214215#4896712, @dmaza wrote:

FWIW I've tested https://gerrit.wikimedia.org/r/485480 and I get the two messages but apparently with different min lengths. It might be my local setup

Looks like you have MinimalPasswordLength set to 10 and MinimalPasswordLengthToLogin set to 7 there, or vice versa.

In T214215#4896712, @dmaza wrote:

Maybe it is not high priority but I would leave a ticket open somewhere to take care of the duplication.

Not sure what would be a reasonable way to handle that. Those are two different messages from two different checks, as far as MediaWiki is concerned.

Change 485480 had a related patch set uploaded (by Reedy; owner: Gergő Tisza):
[mediawiki/core@master] Improve message for fatal password validity errors on login

https://gerrit.wikimedia.org/r/485480

Change 952856 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] Improve message for fatal password validity errors on login

https://gerrit.wikimedia.org/r/952856

In T214215#4896712, @dmaza wrote:

FWIW I've tested https://gerrit.wikimedia.org/r/485480 and I get the two messages but apparently with different min lengths. It might be my local setup

In T214215#4896767, @Anomie wrote:

Looks like you have MinimalPasswordLength set to 10 and MinimalPasswordLengthToLogin set to 7 there, or vice versa.

In T214215#4898082, @Tgr wrote:

Not sure what would be a reasonable way to handle that. Those are two different messages from two different checks, as far as MediaWiki is concerned.

If they're two different messages, I think they should actually be different messages. Currently both checkMinimalPasswordLength() and checkMinimumPasswordLengthToLogin() use the 'passwordtooshort' localisation message. I suggest splitting it into two, worded along the lines of:

• New passwords must be at least {{PLURAL:$1|1 character|$1 characters}}.
• You must change your password to be at least {{PLURAL:$1|1 character|$1 characters}} to log in.

(Still a bit awkward if you get both of these errors, but better than two identical messages with a different number.)

There is no guarantee MinimalPasswordLengthToLogin is shown on login. It can show up when trying to register or changing your password.
Likewise, MinimalPasswordLength doesn't only show when you are trying to set a new password. When the suggestChangeOnLogin policy flag is set, the error is shown on login with an option to change the current password.

Change 485480 merged by jenkins-bot:

[mediawiki/core@master] Improve message for fatal password validity errors on login

https://gerrit.wikimedia.org/r/485480

Change 952856 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Improve message for fatal password validity errors on login

https://gerrit.wikimedia.org/r/952856