手册:$wgPasswordPolicy

This page is a translated version of the page Manual:$wgPasswordPolicy and the translation is 45% complete.
Outdated translations are marked like this.
用户账户、身份验证: $wgPasswordPolicy
指定与密码强度和安全性相关的各种设置。
引进版本:1.26.0 (Gerrit change 206156; git #1a20dc)
移除版本:仍在使用
允许的值:参见下方
默认值:参见下方

细节

密码策略按以下形式

$wgPasswordPolicy = [
    'policies' => [
        'group1' => [
            'check1' => 'value1',
            // ...
        ],
        // ...
    ],
    'checks' => [
        'check1' => 'callable1',
        // ...
    ],
];
  • group1 etc. are user groups, plus the special group default which is required to be present and applies to everyone.
  • check1 etc. are arbitrary check names, defined in the checks subarray.
  • value1 etc. are policy values, passed to the appropriate callback defined in the checks subarray.

If the same check applies to a user via multiple groups, it will be applied with the max() of the values.

    • Alternatively, value1 could be an array with the fields value (same as above), suggestChangeOnLogin (when set to true, users will be shown a password change form during login if the check fails) and forceChange (like suggestChangeOnLogin but the form cannot be skipped).
  • callable1 etc. are PHP callables, which receive three arguments: the defined value, the User object and the password, and return a StatusValue.

A fatal status means the password can't be used, even for login; a non-fatal error means the value is not accepted as a new password (on account creation or password change), but can be used for login; the user will be shown a (skippable) password change form.

  • Default checks (found in includes/password/PasswordPolicyChecks.php):
    • MinimalPasswordLength — 使用者能夠設定的密碼最小長度
    • MinimumPasswordLengthToLogin — 密碼短於這個設定值將不允許登入,無論密碼是否正確。
    • MaximalPasswordLength — 使用者能夠嘗試的最長密碼。 Prevents DoS attacks with pbkdf2.
    • PasswordCannotMatchUsername — 密碼不可符合用戶名
    • PasswordCannotBeSubstringInUsernameYour password must not appear within your username.
    • PasswordCannotMatchBlacklist — 禁用先前已用於MediaWiki單元測試中的密碼。
    • PasswordCannotBePopular — 禁用廣為人知的常用密碼。 設定整數n來禁止前n個密碼。 如果你想要禁止檔案中所有常用密碼,使用常數PHP_INT_MAX參見$wgPopularPasswordFile (MediaWiki中附帶的預設檔案,有1萬個密碼)。
        注意: (在版本1.35移除) Use PasswordNotInCommonList instead.
    • PasswordNotInLargeBlacklistSame as the previous one, except uses the larger blacklist that comes with the wikimedia/password-blacklist library.
        注意: (在1.35版本中已弃用) Use PasswordNotInCommonList instead.
    • PasswordNotInCommonListPassword not in best practices list of 100,000 commonly used passwords.

示例

This example shows how to change selected policies for all users:

$wgPasswordPolicy['policies']['default']['MinimalPasswordLength'] = 10;
$wgPasswordPolicy['policies']['default']['MaximalPasswordLength'] = 128;
$wgPasswordPolicy['policies']['default']['PasswordCannotMatchUsername']['value'] = false;

This example shows how to change selected policies for users of the "sysop" group:

$wgPasswordPolicy['policies']['sysop']['MinimumPasswordLengthToLogin'] = 10;
$wgPasswordPolicy['policies']['sysop']['MinimalPasswordLength'] = 20;

Disabling all password policies

For development machines, it might be helpful to disable all password policies, which can be done with the following line:

  警告: You should never use this on production sites as it reduces the security of your wiki. It should only be used for test/development sites which do not hold any sensitive data.
$wgPasswordPolicy = [ 'policies' => [ 'default' => [] ], 'checks' => [] ];

默认

MediaWiki版本:
1.40
$wgPasswordPolicy = [
	'policies' => [
		'bureaucrat' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'sysop' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'interface-admin' => [	// 1.32+
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'bot' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'default' => [
			'MinimalPasswordLength' => [ 'value' => 8, 'suggestChangeOnLogin' => true ],	// 1.40+
			'PasswordCannotBeSubstringInUsername' => [	// 1.35+
				'value' => true,
				'suggestChangeOnLogin' => true
			],
			'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.35+
			'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.35+
		],
	],
	'checks' => [
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotBeSubstringInUsername' =>
			'PasswordPolicyChecks::checkPasswordCannotBeSubstringInUsername',	// 1.35+
		'PasswordCannotMatchDefaults' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults',	// 1.35+
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
		'PasswordNotInCommonList' => 'PasswordPolicyChecks::checkPasswordNotInCommonList',	// 1.35+
	],
];
MediaWiki版本:
1.37
$wgPasswordPolicy = [
	'policies' => [
		'bureaucrat' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'sysop' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'interface-admin' => [	// 1.32+
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'bot' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'default' => [
			'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotBeSubstringInUsername' => [	// 1.35+
				'value' => true,
				'suggestChangeOnLogin' => true
			],
			'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.35+
			'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.35+
		],
	],
	'checks' => [
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotBeSubstringInUsername' =>
			'PasswordPolicyChecks::checkPasswordCannotBeSubstringInUsername',	// 1.35+
		'PasswordCannotMatchDefaults' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults',	// 1.35+
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
		'PasswordNotInCommonList' => 'PasswordPolicyChecks::checkPasswordNotInCommonList',	// 1.35+
	],
];
MediaWiki版本:
1.36
$wgPasswordPolicy = [
	'policies' => [
		'bureaucrat' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'sysop' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'interface-admin' => [	// 1.32+
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'bot' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'default' => [
			'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotMatchUsername' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotBeSubstringInUsername' => [	// 1.35+
				'value' => true,
				'suggestChangeOnLogin' => true
			],
			'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.35+
			'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.35+
		],
	],
	'checks' => [
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
		'PasswordCannotBeSubstringInUsername' =>
			'PasswordPolicyChecks::checkPasswordCannotBeSubstringInUsername',	// 1.35+
		'PasswordCannotMatchDefaults' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults',	// 1.35+
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
		'PasswordNotInCommonList' => 'PasswordPolicyChecks::checkPasswordNotInCommonList',	// 1.35+
	],
];
MediaWiki版本:
1.35
$wgPasswordPolicy = [
	'policies' => [
		'bureaucrat' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'sysop' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'interface-admin' => [	// 1.32+
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'bot' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'default' => [
			'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotMatchUsername' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotBeSubstringInUsername' => [	// 1.35+
				'value' => true,
				'suggestChangeOnLogin' => true
			],
			'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.35+
			'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.35+
		],
	],
	'checks' => [
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
		'PasswordCannotBeSubstringInUsername' =>
			'PasswordPolicyChecks::checkPasswordCannotBeSubstringInUsername',	// 1.35+
		'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults',	// 1.35
		'PasswordCannotMatchDefaults' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults',	// 1.35+
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
		'PasswordNotInLargeBlacklist' => 'PasswordPolicyChecks::checkPasswordNotInCommonList',	// 1.35
		'PasswordNotInCommonList' => 'PasswordPolicyChecks::checkPasswordNotInCommonList',	// 1.35+
	],
];
MediaWiki版本:
1.34
$wgPasswordPolicy = [
	'policies' => [
		'bureaucrat' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'sysop' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'interface-admin' => [	// 1.32+
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'bot' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
		],
		'default' => [
			'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotMatchUsername' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotMatchBlacklist' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.33+
			'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordNotInLargeBlacklist' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.34+
		],
	],
	'checks' => [
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
		'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
		'PasswordCannotBePopular' => 'PasswordPolicyChecks::checkPopularPasswordBlacklist',	// 1.27+
		'PasswordNotInLargeBlacklist' => 'PasswordPolicyChecks::checkPasswordNotInLargeBlacklist',	// 1.33+
	],
];
MediaWiki版本:
1.33
$wgPasswordPolicy = [
	'policies' => [
		'bureaucrat' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordNotInLargeBlacklist' => true,	// 1.33
		],
		'sysop' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordNotInLargeBlacklist' => true,	// 1.33
		],
		'interface-admin' => [	// 1.32+
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordNotInLargeBlacklist' => true,	// 1.33
		],
		'bot' => [
			'MinimalPasswordLength' => 10,	// 1.33+
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordNotInLargeBlacklist' => true,	// 1.33
		],
		'default' => [
			'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotMatchUsername' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.33+
			'PasswordCannotMatchBlacklist' => [ 'value' => true, 'suggestChangeOnLogin' => true ],	// 1.33+
			'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ],	// 1.33+
		],
	],
	'checks' => [
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
		'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
		'PasswordCannotBePopular' => 'PasswordPolicyChecks::checkPopularPasswordBlacklist',	// 1.27+
		'PasswordNotInLargeBlacklist' => 'PasswordPolicyChecks::checkPasswordNotInLargeBlacklist',	// 1.33+
	],
];
MediaWiki版本:
1.32
$wgPasswordPolicy = [
	'policies' => [
		'bureaucrat' => [
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
			'PasswordCannotBePopular' => 25,	// 1.27+
		],
		'sysop' => [
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
			'PasswordCannotBePopular' => 25,	// 1.27+
		],
		'interface-admin' => [	// 1.32+
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
			'PasswordCannotBePopular' => 25,
		],
		'bot' => [
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
		],
		'default' => [
			'MinimalPasswordLength' => 1,
			'PasswordCannotMatchUsername' => true,
			'PasswordCannotMatchBlacklist' => true,
			'MaximalPasswordLength' => 4096,
		],
	],
	'checks' => [
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
		'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
		'PasswordCannotBePopular' => 'PasswordPolicyChecks::checkPopularPasswordBlacklist'	// 1.27+
	],
];
MediaWiki版本:
1.27 – 1.31
$wgPasswordPolicy = [
	'policies' => [
		'bureaucrat' => [
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
			'PasswordCannotBePopular' => 25,	// 1.27+
		],
		'sysop' => [
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
			'PasswordCannotBePopular' => 25,	// 1.27+
		],
		'bot' => [
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
		],
		'default' => [
			'MinimalPasswordLength' => 1,
			'PasswordCannotMatchUsername' => true,
			'PasswordCannotMatchBlacklist' => true,
			'MaximalPasswordLength' => 4096,
		],
	],
	'checks' => [
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
		'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
		'PasswordCannotBePopular' => 'PasswordPolicyChecks::checkPopularPasswordBlacklist'	// 1.27+
	],
];
MediaWiki版本:
1.26
$wgPasswordPolicy = array(
	'policies' => array(
		'bureaucrat' => array(
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
		),
		'sysop' => array(
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
		),
		'bot' => array(
			'MinimalPasswordLength' => 8,
			'MinimumPasswordLengthToLogin' => 1,
			'PasswordCannotMatchUsername' => true,
		),
		'default' => array(
			'MinimalPasswordLength' => 1,
			'PasswordCannotMatchUsername' => true,
			'PasswordCannotMatchBlacklist' => true,
			'MaximalPasswordLength' => 4096,
		),
	),
	'checks' => array(
		'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
		'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
		'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
		'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
		'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
	),
);


参见