From 5f296ff1c0a8eac98a86fb58f2614314a7d27e8a Mon Sep 17 00:00:00 2001
From: heinzel <heinzel@farbemachtstark.de>
Date: Tue, 22 Dec 2020 11:51:59 +0100
Subject: [PATCH 1/4] UPD: dav_auth: refactor the ResetPasswordView for better
 name

---
 dav_auth/forms.py                             |  2 +-
 dav_auth/templates/dav_auth/forms/login.html  |  3 ++-
 ...t_password.html => recreate_password.html} |  0
 dav_auth/tests/test_forms.py                  |  6 +++---
 dav_auth/tests/test_screenshots.py            | 16 +++++++--------
 dav_auth/tests/test_templates.py              |  6 +++---
 dav_auth/tests/test_urls.py                   |  2 +-
 dav_auth/tests/test_views.py                  | 20 +++++++++----------
 dav_auth/urls.py                              |  2 +-
 dav_auth/views.py                             | 20 ++++++++++++-------
 10 files changed, 42 insertions(+), 35 deletions(-)
 rename dav_auth/templates/dav_auth/forms/{reset_password.html => recreate_password.html} (100%)

diff --git a/dav_auth/forms.py b/dav_auth/forms.py
index d46ce6c..8c1faa4 100644
--- a/dav_auth/forms.py
+++ b/dav_auth/forms.py
@@ -62,7 +62,7 @@ class SetPasswordForm(forms.Form):
         return self.user
 
 
-class ResetPasswordForm(forms.Form):
+class CreateAndSendPasswordForm(forms.Form):
     username = auth_forms.UsernameField(
         max_length=254,
         label=_(u'E-Mail-Adresse'),
diff --git a/dav_auth/templates/dav_auth/forms/login.html b/dav_auth/templates/dav_auth/forms/login.html
index 3f592fb..f914d3f 100644
--- a/dav_auth/templates/dav_auth/forms/login.html
+++ b/dav_auth/templates/dav_auth/forms/login.html
@@ -15,7 +15,8 @@
             <form action="" method="post">
                 {% csrf_token %}
                 {% bootstrap_form form %}
-                <div class="pull-right"><a href="{% url 'dav_auth:reset_password' %}">{% trans 'Passwort vergessen?' %}</a></div>
+                <div class="pull-right"><a
+                        href="{% url 'dav_auth:recreate_password' %}">{% trans 'Passwort vergessen?' %}</a></div>
                 {% buttons %}
                 <button type="submit" class="btn btn-success">
                     {% bootstrap_icon 'log-in' %}&thinsp;
diff --git a/dav_auth/templates/dav_auth/forms/reset_password.html b/dav_auth/templates/dav_auth/forms/recreate_password.html
similarity index 100%
rename from dav_auth/templates/dav_auth/forms/reset_password.html
rename to dav_auth/templates/dav_auth/forms/recreate_password.html
diff --git a/dav_auth/tests/test_forms.py b/dav_auth/tests/test_forms.py
index ece621e..5388d1e 100644
--- a/dav_auth/tests/test_forms.py
+++ b/dav_auth/tests/test_forms.py
@@ -6,7 +6,7 @@ from django.utils.translation import ugettext
 
 from dav_base.tests.generic import FormDataSet, FormsTestCase
 
-from ..forms import LoginForm, SetPasswordForm, ResetPasswordForm
+from ..forms import LoginForm, SetPasswordForm, CreateAndSendPasswordForm
 
 TEST_USERNAME = 'root@localhost'
 TEST_PASSWORD = u'me||ön 2'
@@ -193,8 +193,8 @@ class SetPasswordFormTestCase(FormsTestCase):
             self.assertTrue(self.client.login(username=self.test_username, password=new_password))
 
 
-class ResetPasswordFormTestCase(FormsTestCase):
-    form_class = ResetPasswordForm
+class CreateAndSendPasswordFormTestCase(FormsTestCase):
+    form_class = CreateAndSendPasswordForm
 
     valid_data_sets = (
         FormDataSet({'username': 'unittest@example.com'}),
diff --git a/dav_auth/tests/test_screenshots.py b/dav_auth/tests/test_screenshots.py
index d3fa5b8..70e38fd 100644
--- a/dav_auth/tests/test_screenshots.py
+++ b/dav_auth/tests/test_screenshots.py
@@ -177,10 +177,10 @@ class TestCase(ScreenshotTestCase):
         self.wait_until_stale(c, password2_field)
         self.save_screenshot('set_password_succeed', sequence=sequence_name)
 
-        # Get password reset page -> since we are logged in, it should
+        # Get password recreate page -> since we are logged in, it should
         # redirect to set password page again -> save
         html = c.find_element_by_tag_name('html')
-        c.get(self.complete_url(reverse('dav_auth:reset_password')))
+        c.get(self.complete_url(reverse('dav_auth:recreate_password')))
         self.wait_until_stale(c, html)
         self.wait_on_presence(c, (By.ID, 'id_new_password'))
         self.save_screenshot('empty_set_password_form', sequence=sequence_name)
@@ -194,24 +194,24 @@ class TestCase(ScreenshotTestCase):
         self.wait_until_stale(c, user_menu)
         self.save_screenshot('logout_succeed', sequence=sequence_name)
 
-        # Click on 'login' to access password reset link
+        # Click on 'login' to access password recreate link
         link = c.find_element_by_css_selector('#login-widget a')
         link.click()
         self.wait_on_presence(c, (By.ID, 'id_username'))
 
-        # Locate password reset link, click it -> save password reset form
+        # Locate password recreate link, click it -> save password recreate form
         link = c.find_element_by_partial_link_text(ugettext(u'Passwort vergessen'))
         link.click()
         username_field = self.wait_on_presence(c, (By.ID, 'id_username'))
-        self.save_screenshot('empty_reset_password_form', sequence=sequence_name)
+        self.save_screenshot('empty_recreate_password_form', sequence=sequence_name)
 
         # Enter invalid username -> save result (login form, no message)
         username_field.send_keys(self.test_username[::-1])
         username_field.send_keys(Keys.RETURN)
         self.wait_until_stale(c, username_field)
-        self.save_screenshot('reset_password_invalid_user', sequence=sequence_name)
+        self.save_screenshot('recreate_password_invalid_user', sequence=sequence_name)
 
-        # Locate password reset link, click it
+        # Locate password recreate link, click it
         link = c.find_element_by_partial_link_text(ugettext(u'Passwort vergessen'))
         link.click()
         username_field = self.wait_on_presence(c, (By.ID, 'id_username'))
@@ -220,4 +220,4 @@ class TestCase(ScreenshotTestCase):
         username_field.send_keys(self.test_username)
         username_field.send_keys(Keys.RETURN)
         self.wait_until_stale(c, username_field)
-        self.save_screenshot('reset_password_valid_user', sequence=sequence_name)
+        self.save_screenshot('recreate_password_valid_user', sequence=sequence_name)
diff --git a/dav_auth/tests/test_templates.py b/dav_auth/tests/test_templates.py
index 09b5804..c140bfd 100644
--- a/dav_auth/tests/test_templates.py
+++ b/dav_auth/tests/test_templates.py
@@ -17,11 +17,11 @@ TEST_EMAIL = TEST_USERNAME
 
 
 class TemplatesTestCase(SimpleTestCase):
-    def test_reset_link_in_login_form(self):
+    def test_recreate_link_in_login_form(self):
         login_url = reverse('dav_auth:login')
-        reset_url = reverse('dav_auth:reset_password')
+        recreate_url = reverse('dav_auth:recreate_password')
         text = ugettext('Passwort vergessen?')
-        html = '<a href="{url}">{text}</a>'.format(url=reset_url, text=text)
+        html = '<a href="{url}">{text}</a>'.format(url=recreate_url, text=text)
         response = self.client.get(login_url)
         self.assertInHTML(html, response.content.decode('utf-8'))
 
diff --git a/dav_auth/tests/test_urls.py b/dav_auth/tests/test_urls.py
index dcd2259..5acaf2f 100644
--- a/dav_auth/tests/test_urls.py
+++ b/dav_auth/tests/test_urls.py
@@ -9,5 +9,5 @@ class TestCase(UrlsTestCase):
         Url('/auth/logout', 'dav_auth:logout', views.LogoutView.as_view(), status_code=302),
         Url('/auth/password', 'dav_auth:set_password', views.SetPasswordView.as_view(),
             redirect='/auth/login?next=/auth/password'),
-        Url('/auth/password/reset', 'dav_auth:reset_password', views.ResetPasswordView.as_view()),
+        Url('/auth/password/recreate', 'dav_auth:recreate_password', views.CreateAndSendPasswordView.as_view()),
     )
diff --git a/dav_auth/tests/test_views.py b/dav_auth/tests/test_views.py
index 1a0594a..404650f 100644
--- a/dav_auth/tests/test_views.py
+++ b/dav_auth/tests/test_views.py
@@ -7,7 +7,7 @@ from django.test import TestCase
 from django.utils.translation import ugettext
 from django.urls import reverse
 
-from ..forms import LoginForm, SetPasswordForm, ResetPasswordForm
+from ..forms import LoginForm, SetPasswordForm, CreateAndSendPasswordForm
 
 TEST_USERNAME = 'root@localhost'
 TEST_PASSWORD = u'me||ön 2'
@@ -27,7 +27,7 @@ class ViewsTestCase(TestCase):
         cls.logout_url = reverse('dav_auth:logout')
         cls.logout_redirect_url = resolve_url(cls.app_settings.logout_redirect_url)
         cls.set_password_url = reverse('dav_auth:set_password')
-        cls.reset_password_url = reverse('dav_auth:reset_password')
+        cls.recreate_password_url = reverse('dav_auth:recreate_password')
 
         # Some messages
         cls.wrong_credentials_message = ugettext(u'Benutzername oder Passwort falsch.')
@@ -179,23 +179,23 @@ class ViewsTestCase(TestCase):
         self.assertFalse(self.client.login(username=username, password=password), 'Old password still valid')
         self.assertTrue(self.client.login(username=username, password=new_password), 'New password not valid')
 
-    def test_reset_password_integrated_unauth_get(self):
-        response = self.client.get(self.reset_password_url)
+    def test_recreate_password_integrated_unauth_get(self):
+        response = self.client.get(self.recreate_password_url)
         self.assertEqual(response.status_code, 200)
-        self.assertTemplateUsed(response, 'dav_auth/forms/reset_password.html')
+        self.assertTemplateUsed(response, 'dav_auth/forms/recreate_password.html')
         self.assertIn('form', response.context)
-        self.assertIsInstance(response.context['form'], ResetPasswordForm)
+        self.assertIsInstance(response.context['form'], CreateAndSendPasswordForm)
 
         field = response.context['form'].fields['username']
         self.assertTrue(field.required)
 
-    def test_reset_password_integrated_auth_get(self):
+    def test_recreate_password_integrated_auth_get(self):
         self.client.login(username=self.test_username, password=self.test_password)
-        response = self.client.get(self.reset_password_url)
+        response = self.client.get(self.recreate_password_url)
         self.assertRedirects(response, self.set_password_url)
 
-    def test_reset_password_integrated_post(self):
-        location = self.reset_password_url
+    def test_recreate_password_integrated_post(self):
+        location = self.recreate_password_url
 
         response = self.client.post(location, {'username': self.user.username})
         self.assertRedirects(response, self.login_url)
diff --git a/dav_auth/urls.py b/dav_auth/urls.py
index 14bd7fb..dd3c1b5 100644
--- a/dav_auth/urls.py
+++ b/dav_auth/urls.py
@@ -6,5 +6,5 @@ urlpatterns = [
     url(r'^login$', views.LoginView.as_view(), name='login'),
     url(r'^logout$', views.LogoutView.as_view(), name='logout'),
     url(r'^password$', views.SetPasswordView.as_view(), name='set_password'),
-    url(r'^password/reset$', views.ResetPasswordView.as_view(), name='reset_password'),
+    url(r'^password/recreate$', views.CreateAndSendPasswordView.as_view(), name='recreate_password'),
 ]
diff --git a/dav_auth/views.py b/dav_auth/views.py
index 5e5c078..995c8f5 100644
--- a/dav_auth/views.py
+++ b/dav_auth/views.py
@@ -1,7 +1,9 @@
 import logging
 from django.apps import apps
+from django.core.exceptions import ValidationError
 from django.contrib import messages
 from django.contrib.auth import views as auth_views, get_user_model
+from django.contrib.auth.password_validation import validate_password
 from django.http import HttpResponseRedirect
 from django.shortcuts import resolve_url
 from django.urls import reverse_lazy, reverse
@@ -27,6 +29,10 @@ class LoginView(auth_views.LoginView):
 
     def form_valid(self, form):
         r = super(LoginView, self).form_valid(form)
+        try:
+            validate_password(form.cleaned_data['password'])
+        except ValidationError as e:
+            logger.warning(u'Weak password (%d): %s', self.request.user.pk, e)
         messages.success(self.request, _(u'Benutzer angemeldet: %(username)s') % {'username': form.get_user()})
         return r
 
@@ -60,9 +66,9 @@ class SetPasswordView(auth_views.PasswordChangeView):
         return r
 
 
-class ResetPasswordView(generic.FormView):
-    form_class = forms.ResetPasswordForm
-    template_name = 'dav_auth/forms/reset_password.html'
+class CreateAndSendPasswordView(generic.FormView):
+    form_class = forms.CreateAndSendPasswordForm
+    template_name = 'dav_auth/forms/recreate_password.html'
     success_url = reverse_lazy('dav_auth:login')
 
     def form_valid(self, form):
@@ -76,13 +82,13 @@ class ResetPasswordView(generic.FormView):
             email = emails.PasswordSetEmail(user, random_password)
             email.send()
             messages.success(self.request, _(u'Neues Passwort versendet.'))
-            logger.info('Password reset for user \'%s\'', username)
+            logger.info('Password recreated for user \'%s\'', username)
         except user_model.DoesNotExist:
-            logger.warning('Password reset for unknown user \'%s\'', username)
+            logger.warning('Password recreated for unknown user \'%s\'', username)
 
-        return super(ResetPasswordView, self).form_valid(form)
+        return super(CreateAndSendPasswordView, self).form_valid(form)
 
     def get(self, request, *args, **kwargs):
         if request.user.is_authenticated:
             return HttpResponseRedirect(reverse('dav_auth:set_password'))
-        return super(ResetPasswordView, self).get(request, *args, **kwargs)
+        return super(CreateAndSendPasswordView, self).get(request, *args, **kwargs)

From 0762876ec5b9fdad909d2eaf623aacd3f4e2bd29 Mon Sep 17 00:00:00 2001
From: heinzel <heinzel@farbemachtstark.de>
Date: Tue, 22 Dec 2020 15:53:32 +0100
Subject: [PATCH 2/4] UPD: auth: added score based password validator

---
 dav_auth/tests/test_validators.py | 170 ++++++++++++++++++++++++++++++
 dav_auth/validators.py            | 161 ++++++++++++++++++++++++++++
 2 files changed, 331 insertions(+)
 create mode 100644 dav_auth/tests/test_validators.py
 create mode 100644 dav_auth/validators.py

diff --git a/dav_auth/tests/test_validators.py b/dav_auth/tests/test_validators.py
new file mode 100644
index 0000000..31af7a2
--- /dev/null
+++ b/dav_auth/tests/test_validators.py
@@ -0,0 +1,170 @@
+# -*- coding: utf-8 -*-
+from django.core.exceptions import ValidationError
+from django.test import SimpleTestCase
+
+from ..validators import PasswordScoreValidator, CharacterClassPasswordValidator
+
+
+class PasswordScoreValidatorTestCase(SimpleTestCase):
+    def test_too_little_score(self):
+        passwords = [
+            '',  # score = 0
+            'abcdefghijklmnopq',  # score = 17
+            'Abcdefghijklmnop',  # score = 16 + 1
+            'ABcdefghijklmno',  # score = 15 + 2
+            'AB1defghijklmn',  # score = 14 + 2 + 1
+            'AB12efghijklm',  # score = 13 + 2 + 2
+            'AB12+fghijkl',  # score = 12 + 2 + 2 + 1
+            'AB12+-ghijk',  # score = 11 + 2 + 2 + 2
+            'AB12+-*hij',  # score = 10 + 2 + 2 + 3
+            'AB12+-*hi/',  # score = 10 + 2 + 2 + 3
+            'AB12+-*hi3',  # score = 10 + 2 + 2 + 3
+            'AB12+-*hiC',  # score = 10 + 2 + 2 + 3
+            'abcbbbgbbjklmnopqr',  # score = 17
+        ]
+
+        validator = PasswordScoreValidator(min_classes=0)
+
+        for password in passwords:
+            try:
+                validator.validate(password)
+            except ValidationError as e:
+                self.assertEqual('too_little_score', e.code)
+            else:
+                self.fail('%s: no validation error was raised' % password)
+
+    def test_too_few_classes(self):
+        passwords = [
+            '',  # classes = 0
+            'abcdefgh',  # classes = 1
+            'abcdef+-',  # classes = 2
+            'abcd12gh',  # classes = 2
+            'abcd12-+',  # classes = 3
+            'abCDefgh',  # classes = 2
+            'abCDef+-',  # classes = 3
+            'abCD12gh',  # classes = 3
+            'ABCD12-+',  # classes = 3
+        ]
+
+        validator = PasswordScoreValidator(min_score=0, min_classes=4)
+
+        for password in passwords:
+            try:
+                validator.validate(password)
+            except ValidationError as e:
+                self.assertEqual('too_few_classes', e.code)
+            else:
+                self.fail('%s: no validation error was raised' % password)
+
+    def test_valid(self):
+        passwords = [
+            'Abcdefghijklmnopq',
+            'ABcdefghijklmnop',
+            'AB1defghijklmno',
+            'AB12efghijklmn',
+            'AB12+fghijklm',
+            'AB12+-ghijkl',
+            'AB12+-*hijk',
+            'ab1defghijklmnopq',
+            'abcd+fghijklmnopq',
+            'AB1CDEFGHIJKLMNOPQ',
+        ]
+
+        validator = PasswordScoreValidator()
+
+        for password in passwords:
+            try:
+                validator.validate(password)
+            except ValidationError as e:
+                self.fail(e)
+
+
+class CharacterClassPasswordValidatorTestCase(SimpleTestCase):
+    def setUp(self):
+        super(CharacterClassPasswordValidatorTestCase, self).setUp()
+        self.validator = CharacterClassPasswordValidator()
+
+    def test_invalid(self):
+        invalid_passwords = [
+            ('', [
+                u'The password must contain at least 2 characters from a-z',
+                u'The password must contain at least 2 characters from A-Z',
+                u'The password must contain at least 2 digits from 0-9',
+                u'The password must contain at least 2 non alpha numeric characters',
+            ]),
+            ('A+-', [
+                u'The password must contain at least 2 characters from a-z',
+                u'The password must contain at least 2 characters from A-Z',
+                u'The password must contain at least 2 digits from 0-9',
+            ]),
+            ('1234567890*', [
+                u'The password must contain at least 2 characters from a-z',
+                u'The password must contain at least 2 characters from A-Z',
+                u'The password must contain at least 2 non alpha numeric characters',
+            ]),
+            ('34*/()', [
+                u'The password must contain at least 2 characters from a-z',
+                u'The password must contain at least 2 characters from A-Z',
+            ]),
+            ('AA', [
+                u'The password must contain at least 2 characters from a-z',
+                u'The password must contain at least 2 digits from 0-9',
+                u'The password must contain at least 2 non alpha numeric characters',
+            ]),
+            ('CD0.,', [
+                u'The password must contain at least 2 characters from a-z',
+                u'The password must contain at least 2 digits from 0-9',
+            ]),
+            ('EF56', [
+                u'The password must contain at least 2 characters from a-z',
+                u'The password must contain at least 2 non alpha numeric characters',
+            ]),
+            ('8GH?!8', [
+                u'The password must contain at least 2 characters from a-z',
+            ]),
+            ('bbX', [
+                u'The password must contain at least 2 characters from A-Z',
+                u'The password must contain at least 2 digits from 0-9',
+                u'The password must contain at least 2 non alpha numeric characters',
+            ]),
+            ('$cd%', [
+                u'The password must contain at least 2 characters from A-Z',
+                u'The password must contain at least 2 digits from 0-9',
+            ]),
+            ('ef90', [
+                u'The password must contain at least 2 characters from A-Z',
+                u'The password must contain at least 2 non alpha numeric characters',
+            ]),
+            ('1g=h3~', [
+                u'The password must contain at least 2 characters from A-Z',
+            ]),
+            ('Gi&jH', [
+                u'The password must contain at least 2 digits from 0-9',
+                u'The password must contain at least 2 non alpha numeric characters',
+            ]),
+            ('IkK:i;', [
+                u'The password must contain at least 2 digits from 0-9',
+            ]),
+            ('mKn4L8', [
+                u'The password must contain at least 2 non alpha numeric characters',
+            ]),
+        ]
+        for password, expected_errors in invalid_passwords:
+            try:
+                self.validator.validate(password)
+            except ValidationError as e:
+                errors = e.messages
+                for expected_error in expected_errors:
+                    self.assertIn(expected_error, errors)
+                for error in errors:
+                    self.assertIn(error, expected_errors)
+            else:
+                self.fail('%s: no validation error was raised' % password)
+
+    def test_valid(self):
+        valid_passwords = ['abCD12+-']
+        for password in valid_passwords:
+            try:
+                self.validator.validate(password)
+            except ValidationError as e:
+                self.fail(e)
diff --git a/dav_auth/validators.py b/dav_auth/validators.py
new file mode 100644
index 0000000..ed796b9
--- /dev/null
+++ b/dav_auth/validators.py
@@ -0,0 +1,161 @@
+# -*- coding: utf-8 -*-
+import re
+from django.core.exceptions import ValidationError
+from django.utils.translation import gettext as _
+
+
+class CharacterClassPasswordValidator(object):
+    def _is_enough_lower(self, password):
+        lower = re.sub(r'[^a-z]', '', password)
+        if len(lower) < self.minimum_lower:
+            return False
+        return True
+
+    def _is_enough_upper(self, password):
+        upper = re.sub(r'[^A-Z]', '', password)
+        if len(upper) < self.minimum_upper:
+            return False
+        return True
+
+    def _is_enough_digits(self, password):
+        digits = re.sub(r'[^0-9]', '', password)
+        if len(digits) < self.minimum_digits:
+            return False
+        return True
+
+    def _is_enough_others(self, password):
+        others = re.sub(r'[a-zA-Z0-9]', '', password)
+        if len(others) < self.minimum_others:
+            return False
+        return True
+
+    def __init__(self, minimum_lower=2, minimum_upper=2, minimum_digits=2, minimum_others=2):
+        self.minimum_lower = minimum_lower
+        self.minimum_upper = minimum_upper
+        self.minimum_digits = minimum_digits
+        self.minimum_others = minimum_others
+
+    def validate(self, password, user=None):
+        errors = []
+        if not self._is_enough_lower(password):
+            errors.append(ValidationError(_(u'The password must contain at least %(min_lower)d characters from a-z'),
+                                          code='too_few_lower_characters',
+                                          params={'min_lower': self.minimum_lower}))
+        if not self._is_enough_upper(password):
+            errors.append(ValidationError(_(u'The password must contain at least %(min_upper)d characters from A-Z'),
+                                          code='too_few_upper_characters',
+                                          params={'min_upper': self.minimum_upper}))
+        if not self._is_enough_digits(password):
+            errors.append(ValidationError(_(u'The password must contain at least %(min_digits)d digits from 0-9'),
+                                          code='too_few_digits',
+                                          params={'min_digits': self.minimum_digits}))
+        if not self._is_enough_others(password):
+            errors.append(ValidationError(_(u'The password must contain at least %(min_others)d'
+                                            u' non alpha numeric characters'),
+                                          code='too_few_other_characters',
+                                          params={'min_others': self.minimum_others}))
+        if errors:
+            raise ValidationError(errors)
+
+    def get_help_text(self):
+        text = u'%s %s %s %s' % (
+            _('The password must contain at least %d characters from a-z.') % self.minimum_lower,
+            _('The password must contain at least %d characters from A-Z.') % self.minimum_upper,
+            _('The password must contain at least %d digits from 0-9.') % self.minimum_digits,
+            _('The password must contain at least %d non alpha numeric characters.') % self.minimum_others,
+        )
+        return text
+
+
+class PasswordScoreValidator(object):
+    def _get_score(self, password, user=None):
+        score = 0
+        char_counters = {}
+        used_classes = []
+        credits = {
+            'lower': self.lcredit,
+            'upper': self.ucredit,
+            'digit': self.dcredit,
+            'other': self.ocredit,
+        }
+
+        for c in password:
+            if c not in char_counters:
+                char_counters[c] = 1
+            else:
+                char_counters[c] += 1
+            if (self.max_repeat > 0) and (char_counters[c] > self.max_repeat):
+                continue
+
+            score += 1
+
+            if c.isalpha() and c.islower():
+                char_class = 'lower'
+            elif c.isupper():
+                char_class = 'upper'
+            elif c.isdigit():
+                char_class = 'digit'
+            else:
+                char_class = 'other'
+
+            if char_class not in used_classes:
+                used_classes.append(char_class)
+            if credits[char_class] > 0:
+                score += 1
+                credits[char_class] -= 1
+
+        return score, len(used_classes)
+
+    def __init__(self, min_score=18, max_repeat=5, lcredit=0, ucredit=2, dcredit=2, ocredit=3, min_classes=2):
+        self.min_score = min_score
+        self.max_repeat = max_repeat
+        self.lcredit = lcredit
+        self.ucredit = ucredit
+        self.dcredit = dcredit
+        self.ocredit = ocredit
+        self.min_classes = min_classes
+
+    def validate(self, password, user=None):
+        score, used_classes = self._get_score(password, user=user)
+
+        if used_classes < self.min_classes:
+            raise ValidationError(_(u'The password must contain characters from at least %(min_classes)d'
+                                    u' different character classes (i.e. lower, upper, digits, others).'),
+                                  code='too_few_classes',
+                                  params={'min_classes': self.min_classes})
+
+        if score < self.min_score:
+            raise ValidationError(_(u'The password is too simple. Use more characters'
+                                    u' and maybe use more different character classes'
+                                    u' (i.e. lower, upper, digits, others).'),
+                                  code='too_little_score')
+
+        return score
+
+    def get_help_text(self):
+        text = u'%s\n%s' % (
+            _(u'The password must get a minimum score of %d points.') % self.min_score,
+            _(u'For each character the score is increased by 1 point.'),
+        )
+        if self.lcredit > 0:
+            text += '\n'
+            text += _(u'The first %d lower characters increase the score by 1 point each.') % self.lcredit
+        if self.ucredit > 0:
+            text += '\n'
+            text += _(u'The first %d upper characters increase the score by 1 point each.') % self.ucredit
+        if self.dcredit > 0:
+            text += '\n'
+            text += _(u'The first %d digits increase the score by 1 point each.') % self.dcredit
+        if self.ocredit > 0:
+            text += '\n'
+            text += _(u'The first %d non alpha numeric characters'
+                      u' increase the score by 1 point each.') % self.ocredit
+        if self.max_repeat > 0:
+            text += '\n'
+            text += _(u'If a particular character is used more than %d times,'
+                      u' it will not increase the score anymore.') % self.max_repeat
+        if self.min_classes > 0:
+            text += '\n'
+            text += _(u'Also the password must contain characters from %d different character classes'
+                      u' (i.e. lower, upper, digits, others).') % self.min_classes
+        return text

From 47dd196c6a2b5bc828f795acbe5f89c2173eb75e Mon Sep 17 00:00:00 2001
From: heinzel <heinzel@farbemachtstark.de>
Date: Tue, 22 Dec 2020 17:04:40 +0100
Subject: [PATCH 3/4] UPD: auth: added a custom wordlist password validator

---
 dav_auth/tests/test_validators.py | 165 ++++++++++++++++++++----------
 dav_auth/validators.py            | 165 ++++++++++++++++++------------
 2 files changed, 213 insertions(+), 117 deletions(-)

diff --git a/dav_auth/tests/test_validators.py b/dav_auth/tests/test_validators.py
index 31af7a2..faff32e 100644
--- a/dav_auth/tests/test_validators.py
+++ b/dav_auth/tests/test_validators.py
@@ -2,25 +2,25 @@
 from django.core.exceptions import ValidationError
 from django.test import SimpleTestCase
 
-from ..validators import PasswordScoreValidator, CharacterClassPasswordValidator
+from ..validators import PasswordScoreValidator, CustomWordlistPasswordValidator, CharacterClassPasswordValidator
 
 
 class PasswordScoreValidatorTestCase(SimpleTestCase):
     def test_too_little_score(self):
         passwords = [
-            '',  # score = 0
-            'abcdefghijklmnopq',  # score = 17
-            'Abcdefghijklmnop',  # score = 16 + 1
-            'ABcdefghijklmno',  # score = 15 + 2
-            'AB1defghijklmn',  # score = 14 + 2 + 1
-            'AB12efghijklm',  # score = 13 + 2 + 2
-            'AB12+fghijkl',  # score = 12 + 2 + 2 + 1
-            'AB12+-ghijk',  # score = 11 + 2 + 2 + 2
-            'AB12+-*hij',  # score = 10 + 2 + 2 + 3
-            'AB12+-*hi/',  # score = 10 + 2 + 2 + 3
-            'AB12+-*hi3',  # score = 10 + 2 + 2 + 3
-            'AB12+-*hiC',  # score = 10 + 2 + 2 + 3
-            'abcbbbgbbjklmnopqr',  # score = 17
+            u'',  # score = 0
+            u'abcdefghijklmnopq',  # score = 17
+            u'Abcdefghijklmnop',  # score = 16 + 1
+            u'ABcdefghijklmno',  # score = 15 + 2
+            u'AB1defghijklmn',  # score = 14 + 2 + 1
+            u'AB12efghijklm',  # score = 13 + 2 + 2
+            u'AB12+fghijkl',  # score = 12 + 2 + 2 + 1
+            u'AB12+-ghijk',  # score = 11 + 2 + 2 + 2
+            u'AB12+-*hij',  # score = 10 + 2 + 2 + 3
+            u'AB12+-*hi/',  # score = 10 + 2 + 2 + 3
+            u'AB12+-*hi3',  # score = 10 + 2 + 2 + 3
+            u'AB12+-*hiC',  # score = 10 + 2 + 2 + 3
+            u'abcbbbgbbjklmnopqr',  # score = 17
         ]
 
         validator = PasswordScoreValidator(min_classes=0)
@@ -31,19 +31,19 @@ class PasswordScoreValidatorTestCase(SimpleTestCase):
             except ValidationError as e:
                 self.assertEqual('too_little_score', e.code)
             else:
-                self.fail('%s: no validation error was raised' % password)
+                self.fail(u'%s: no validation error was raised' % password)
 
     def test_too_few_classes(self):
         passwords = [
-            '',  # classes = 0
-            'abcdefgh',  # classes = 1
-            'abcdef+-',  # classes = 2
-            'abcd12gh',  # classes = 2
-            'abcd12-+',  # classes = 3
-            'abCDefgh',  # classes = 2
-            'abCDef+-',  # classes = 3
-            'abCD12gh',  # classes = 3
-            'ABCD12-+',  # classes = 3
+            u'',  # classes = 0
+            u'abcdefgh',  # classes = 1
+            u'abcdef+-',  # classes = 2
+            u'abcd12gh',  # classes = 2
+            u'abcd12-+',  # classes = 3
+            u'abCDefgh',  # classes = 2
+            u'abCDef+-',  # classes = 3
+            u'abCD12gh',  # classes = 3
+            u'ABCD12-+',  # classes = 3
         ]
 
         validator = PasswordScoreValidator(min_score=0, min_classes=4)
@@ -54,20 +54,20 @@ class PasswordScoreValidatorTestCase(SimpleTestCase):
             except ValidationError as e:
                 self.assertEqual('too_few_classes', e.code)
             else:
-                self.fail('%s: no validation error was raised' % password)
+                self.fail(u'%s: no validation error was raised' % password)
 
     def test_valid(self):
         passwords = [
-            'Abcdefghijklmnopq',
-            'ABcdefghijklmnop',
-            'AB1defghijklmno',
-            'AB12efghijklmn',
-            'AB12+fghijklm',
-            'AB12+-ghijkl',
-            'AB12+-*hijk',
-            'ab1defghijklmnopq',
-            'abcd+fghijklmnopq',
-            'AB1CDEFGHIJKLMNOPQ',
+            u'Abcdefghijklmnopq',
+            u'ABcdefghijklmnop',
+            u'AB1defghijklmno',
+            u'AB12efghijklmn',
+            u'AB12+fghijklm',
+            u'AB12+-ghijkl',
+            u'AB12+-*hijk',
+            u'ab1defghijklmnopq',
+            u'abcd+fghijklmnopq',
+            u'AB1CDEFGHIJKLMNOPQ',
         ]
 
         validator = PasswordScoreValidator()
@@ -79,6 +79,59 @@ class PasswordScoreValidatorTestCase(SimpleTestCase):
                 self.fail(e)
 
 
+class CustomWordlistPasswordValidatorTestCase(SimpleTestCase):
+    def test_invalid(self):
+        invalid_passwords = [
+            (u'passwort', [
+                u'The password must not contain the word \'passwort\'',
+            ]),
+            (u'abcdDaVefgh', [
+                u'The password must not contain the word \'dav\'',
+            ]),
+            (u'abcdsektIonefgh', [
+                u'The password must not contain the word \'sektion\'',
+            ]),
+            (u'alpen12verein34KArlsruhE  berge', [
+                u'The password must not contain the word \'karlsruhe\'',
+                u'The password must not contain the word \'berge\'',
+            ]),
+            (u'heinzel@alpenverein-karlsruhe.de', [
+                u'The password must not contain the word \'heinzel\'',
+                u'The password must not contain the word \'alpenverein\'',
+                u'The password must not contain the word \'karlsruhe\'',
+            ]),
+        ]
+
+        validator = CustomWordlistPasswordValidator()
+
+        for password, expected_errors in invalid_passwords:
+            try:
+                validator.validate(password)
+            except ValidationError as e:
+                errors = e.messages
+                for expected_error in expected_errors:
+                    self.assertIn(expected_error, errors)
+                for error in errors:
+                    self.assertIn(error, expected_errors)
+            else:
+                self.fail(u'%s: no validation error was raised' % password)
+
+    def test_valid(self):
+        passwords = [
+            u'',
+            u'password',
+            u'münchen',
+        ]
+
+        validator = CustomWordlistPasswordValidator()
+
+        for password in passwords:
+            try:
+                validator.validate(password)
+            except ValidationError as e:
+                self.fail(e)
+
+
 class CharacterClassPasswordValidatorTestCase(SimpleTestCase):
     def setUp(self):
         super(CharacterClassPasswordValidatorTestCase, self).setUp()
@@ -86,72 +139,75 @@ class CharacterClassPasswordValidatorTestCase(SimpleTestCase):
 
     def test_invalid(self):
         invalid_passwords = [
-            ('', [
+            (u'', [
                 u'The password must contain at least 2 characters from a-z',
                 u'The password must contain at least 2 characters from A-Z',
                 u'The password must contain at least 2 digits from 0-9',
                 u'The password must contain at least 2 non alpha numeric characters',
             ]),
-            ('A+-', [
+            (u'A+-', [
                 u'The password must contain at least 2 characters from a-z',
                 u'The password must contain at least 2 characters from A-Z',
                 u'The password must contain at least 2 digits from 0-9',
             ]),
-            ('1234567890*', [
+            (u'1234567890*', [
                 u'The password must contain at least 2 characters from a-z',
                 u'The password must contain at least 2 characters from A-Z',
                 u'The password must contain at least 2 non alpha numeric characters',
             ]),
-            ('34*/()', [
+            (u'34*/()', [
                 u'The password must contain at least 2 characters from a-z',
                 u'The password must contain at least 2 characters from A-Z',
             ]),
-            ('AA', [
+            (u'AA', [
                 u'The password must contain at least 2 characters from a-z',
                 u'The password must contain at least 2 digits from 0-9',
                 u'The password must contain at least 2 non alpha numeric characters',
             ]),
-            ('CD0.,', [
+            (u'CD0.,', [
                 u'The password must contain at least 2 characters from a-z',
                 u'The password must contain at least 2 digits from 0-9',
             ]),
-            ('EF56', [
+            (u'EF56', [
                 u'The password must contain at least 2 characters from a-z',
                 u'The password must contain at least 2 non alpha numeric characters',
             ]),
-            ('8GH?!8', [
+            (u'8GH?!8', [
                 u'The password must contain at least 2 characters from a-z',
             ]),
-            ('bbX', [
+            (u'bbX', [
                 u'The password must contain at least 2 characters from A-Z',
                 u'The password must contain at least 2 digits from 0-9',
                 u'The password must contain at least 2 non alpha numeric characters',
             ]),
-            ('$cd%', [
+            (u'$cd%', [
                 u'The password must contain at least 2 characters from A-Z',
                 u'The password must contain at least 2 digits from 0-9',
             ]),
-            ('ef90', [
+            (u'ef90', [
                 u'The password must contain at least 2 characters from A-Z',
                 u'The password must contain at least 2 non alpha numeric characters',
             ]),
-            ('1g=h3~', [
+            (u'1g=h3~', [
                 u'The password must contain at least 2 characters from A-Z',
             ]),
-            ('Gi&jH', [
+            (u'Gi&jH', [
                 u'The password must contain at least 2 digits from 0-9',
                 u'The password must contain at least 2 non alpha numeric characters',
             ]),
-            ('IkK:i;', [
+            (u'IkK:i;', [
                 u'The password must contain at least 2 digits from 0-9',
             ]),
-            ('mKn4L8', [
+            (u'mKn4L8', [
                 u'The password must contain at least 2 non alpha numeric characters',
             ]),
         ]
+
+        validator = self.validator
+
         for password, expected_errors in invalid_passwords:
             try:
-                self.validator.validate(password)
+                validator.validate(password)
             except ValidationError as e:
                 errors = e.messages
                 for expected_error in expected_errors:
@@ -159,12 +215,13 @@ class CharacterClassPasswordValidatorTestCase(SimpleTestCase):
                 for error in errors:
                     self.assertIn(error, expected_errors)
             else:
-                self.fail('%s: no validation error was raised' % password)
+                self.fail(u'%s: no validation error was raised' % password)
 
     def test_valid(self):
-        valid_passwords = ['abCD12+-']
+        valid_passwords = [u'abCD12+-']
+        validator = self.validator
         for password in valid_passwords:
             try:
-                self.validator.validate(password)
+                validator.validate(password)
             except ValidationError as e:
                 self.fail(e)
diff --git a/dav_auth/validators.py b/dav_auth/validators.py
index ed796b9..f1c4ba6 100644
--- a/dav_auth/validators.py
+++ b/dav_auth/validators.py
@@ -4,69 +4,6 @@ from django.core.exceptions import ValidationError
 from django.utils.translation import gettext as _
 
 
-class CharacterClassPasswordValidator(object):
-    def _is_enough_lower(self, password):
-        lower = re.sub(r'[^a-z]', '', password)
-        if len(lower) < self.minimum_lower:
-            return False
-        return True
-
-    def _is_enough_upper(self, password):
-        upper = re.sub(r'[^A-Z]', '', password)
-        if len(upper) < self.minimum_upper:
-            return False
-        return True
-
-    def _is_enough_digits(self, password):
-        digits = re.sub(r'[^0-9]', '', password)
-        if len(digits) < self.minimum_digits:
-            return False
-        return True
-
-    def _is_enough_others(self, password):
-        others = re.sub(r'[a-zA-Z0-9]', '', password)
-        if len(others) < self.minimum_others:
-            return False
-        return True
-
-    def __init__(self, minimum_lower=2, minimum_upper=2, minimum_digits=2, minimum_others=2):
-        self.minimum_lower = minimum_lower
-        self.minimum_upper = minimum_upper
-        self.minimum_digits = minimum_digits
-        self.minimum_others = minimum_others
-
-    def validate(self, password, user=None):
-        errors = []
-        if not self._is_enough_lower(password):
-            errors.append(ValidationError(_(u'The password must contain at least %(min_lower)d characters from a-z'),
-                                          code='too_few_lower_characters',
-                                          params={'min_lower': self.minimum_lower}))
-        if not self._is_enough_upper(password):
-            errors.append(ValidationError(_(u'The password must contain at least %(min_upper)d characters from A-Z'),
-                                          code='too_few_upper_characters',
-                                          params={'min_upper': self.minimum_upper}))
-        if not self._is_enough_digits(password):
-            errors.append(ValidationError(_(u'The password must contain at least %(min_digits)d digits from 0-9'),
-                                          code='too_few_digits',
-                                          params={'min_digits': self.minimum_digits}))
-        if not self._is_enough_others(password):
-            errors.append(ValidationError(_(u'The password must contain at least %(min_others)d'
-                                            u' non alpha numeric characters'),
-                                          code='too_few_other_characters',
-                                          params={'min_others': self.minimum_others}))
-        if errors:
-            raise ValidationError(errors)
-
-    def get_help_text(self):
-        text = u'%s %s %s %s' % (
-            _('The password must contain at least %d characters from a-z.') % self.minimum_lower,
-            _('The password must contain at least %d characters from A-Z.') % self.minimum_upper,
-            _('The password must contain at least %d digits from 0-9.') % self.minimum_digits,
-            _('The password must contain at least %d non alpha numeric characters.') % self.minimum_others,
-        )
-        return text
-
-
 class PasswordScoreValidator(object):
     def _get_score(self, password, user=None):
         score = 0
@@ -159,3 +96,105 @@ class PasswordScoreValidator(object):
             text += _(u'Also the password must contain characters from %d different character classes'
                       u' (i.e. lower, upper, digits, others).') % self.min_classes
         return text
+
+
+class CustomWordlistPasswordValidator(object):
+    context = 'the Sektion Karlsruhe'
+    words = (
+        u'dav',
+        u'berge',
+        u'sektion',
+        u'karlsruhe',
+        u'alpenverein',
+        u'heinzel',
+        u'passwort',
+    )
+
+    def validate(self, password, user=None):
+        errors = []
+
+        lower_pw = password.lower()
+        for word in self.words:
+            if word in lower_pw:
+                error = ValidationError(_(u'The password must not contain the word \'%(word)s\''),
+                                        code='forbidden_word',
+                                        params={'word': word})
+                errors.append(error)
+
+        if errors:
+            raise ValidationError(errors)
+
+    def get_help_text(self):
+        text = _(u'The password must not contain some specific words,'
+                 u' that are common in context with %(context)s.') % {'context': self.context}
+        text += u'\n'
+        text += _(u'All words are matched case insensitive.')
+        return text
+
+
+class CharacterClassPasswordValidator(object):
+    def _is_enough_lower(self, password):
+        lower = re.sub(r'[^a-z]', '', password)
+        if len(lower) < self.minimum_lower:
+            return False
+        return True
+
+    def _is_enough_upper(self, password):
+        upper = re.sub(r'[^A-Z]', '', password)
+        if len(upper) < self.minimum_upper:
+            return False
+        return True
+
+    def _is_enough_digits(self, password):
+        digits = re.sub(r'[^0-9]', '', password)
+        if len(digits) < self.minimum_digits:
+            return False
+        return True
+
+    def _is_enough_others(self, password):
+        others = re.sub(r'[a-zA-Z0-9]', '', password)
+        if len(others) < self.minimum_others:
+            return False
+        return True
+
+    def __init__(self, minimum_lower=2, minimum_upper=2, minimum_digits=2, minimum_others=2):
+        self.minimum_lower = minimum_lower
+        self.minimum_upper = minimum_upper
+        self.minimum_digits = minimum_digits
+        self.minimum_others = minimum_others
+
+    def validate(self, password, user=None):
+        errors = []
+        if not self._is_enough_lower(password):
+            error = ValidationError(_(u'The password must contain at least %(min_lower)d characters from a-z'),
+                                    code='too_few_lower_characters',
+                                    params={'min_lower': self.minimum_lower})
+            errors.append(error)
+        if not self._is_enough_upper(password):
+            error = ValidationError(_(u'The password must contain at least %(min_upper)d characters from A-Z'),
+                                    code='too_few_upper_characters',
+                                    params={'min_upper': self.minimum_upper})
+            errors.append(error)
+        if not self._is_enough_digits(password):
+            error = ValidationError(_(u'The password must contain at least %(min_digits)d digits from 0-9'),
+                                    code='too_few_digits',
+                                    params={'min_digits': self.minimum_digits})
+            errors.append(error)
+        if not self._is_enough_others(password):
+            error = ValidationError(_(u'The password must contain at least %(min_others)d'
+                                      u' non alpha numeric characters'),
+                                    code='too_few_other_characters',
+                                    params={'min_others': self.minimum_others})
+            errors.append(error)
+
+        if errors:
+            raise ValidationError(errors)
+
+    def get_help_text(self):
+        text = u'%s %s %s %s' % (
+            _('The password must contain at least %d characters from a-z.') % self.minimum_lower,
+            _('The password must contain at least %d characters from A-Z.') % self.minimum_upper,
+            _('The password must contain at least %d digits from 0-9.') % self.minimum_digits,
+            _('The password must contain at least %d non alpha numeric characters.') % self.minimum_others,
+        )
+        return text

From c3f72a50ffd088ead2e9fc2a6c271f0f1fbc4c0b Mon Sep 17 00:00:00 2001
From: heinzel <heinzel@farbemachtstark.de>
Date: Tue, 22 Dec 2020 18:42:06 +0100
Subject: [PATCH 4/4] UPD: enable stronger password validation and eventually
 warning message on login

---
 .../dav_auth/forms/set_password.html          | 34 ++++++++
 dav_auth/tests/test_emails.py                 |  2 +-
 dav_auth/tests/test_forms.py                  | 11 +--
 dav_auth/tests/test_screenshots.py            |  2 +-
 dav_auth/tests/test_templates.py              |  2 +-
 dav_auth/tests/test_validators.py             | 80 +++++++++----------
 dav_auth/tests/test_views.py                  |  2 +-
 dav_auth/validators.py                        | 22 ++---
 dav_auth/views.py                             | 14 +++-
 .../additional_settings.py                    | 24 ++++++
 dav_events/tests/test_screenshots.py          |  2 +-
 11 files changed, 132 insertions(+), 63 deletions(-)

diff --git a/dav_auth/templates/dav_auth/forms/set_password.html b/dav_auth/templates/dav_auth/forms/set_password.html
index 5abe91f..7fc15fc 100644
--- a/dav_auth/templates/dav_auth/forms/set_password.html
+++ b/dav_auth/templates/dav_auth/forms/set_password.html
@@ -32,4 +32,38 @@
         &nbsp;
     </div>
 </div>
+<div class="row">
+    <div class="col-sm-2">
+        &nbsp;
+    </div>
+    <div class="col-sm-8">
+        <h3 class="top-most">{% trans 'Passwortrichtlinien' %}</h3>
+        <div class="well">
+            <p>
+                Damit die persönlichen Daten unserer Teilnehmer jederzeit geschützt sind, ist es unabdingbar,
+                dass eure Passwörter für das Touren- & Kurse-Portal nicht einfach zu erraten sind.
+            </p>
+            <p>
+                Je länger das Passwort ist und je mehr <i>ungewöhnliche</i> Zeichen darin enthalten sind,
+                umso unwahrscheinlicher ist es, dass das Passwort erraten werden kann.
+            </p>
+            <p>
+                Um sicher zu stellen, dass eure Passwörter ausreichend lang sind und nicht nur
+                aus einfachen Wörtern bestehen, wird die Güte eures Passwortes mit Punkten bewertet.<br />
+                Ausserdem dürfen bestimmte Wörter nicht enthalten sein (z.B. Karlsruhe).
+            </p>
+            <p>
+                Mehr Zeichen geben mehr Punkte. Und Großbuchstaben, Ziffern und Sonderzeichen geben Extrapunkte.
+            </p>
+            <p>
+                Im Regelfall sollte euer Passwort aus mindestens 12 Zeichen bestehen,
+                darunter mindestens je zwei Großbuchstaben, Ziffern und Sonderzeichen.<br />
+                Nehmt da ruhig alles, was eure Tastatur so hergibt.
+            </p>
+        </div>
+    </div>
+    <div class="col-sm-3">
+        &nbsp;
+    </div>
+</div>
 {% endblock page-container %}
diff --git a/dav_auth/tests/test_emails.py b/dav_auth/tests/test_emails.py
index b962ec1..5696276 100644
--- a/dav_auth/tests/test_emails.py
+++ b/dav_auth/tests/test_emails.py
@@ -9,7 +9,7 @@ from ..emails import PasswordSetEmail
 
 
 TEST_USERNAME = 'user'
-TEST_PASSWORD = u'me||ön 2'
+TEST_PASSWORD = u'me||ön 21ABll'
 TEST_EMAIL = 'root@localhost'
 
 PASSWORD_EMAIL_TEMPLATE = u"""Hallo {fullname},
diff --git a/dav_auth/tests/test_forms.py b/dav_auth/tests/test_forms.py
index 5388d1e..d02c9ba 100644
--- a/dav_auth/tests/test_forms.py
+++ b/dav_auth/tests/test_forms.py
@@ -9,7 +9,7 @@ from dav_base.tests.generic import FormDataSet, FormsTestCase
 from ..forms import LoginForm, SetPasswordForm, CreateAndSendPasswordForm
 
 TEST_USERNAME = 'root@localhost'
-TEST_PASSWORD = u'me||ön 2'
+TEST_PASSWORD = u'me||ön 21ABll'
 TEST_EMAIL = TEST_USERNAME
 USERNAME_MAX_LENGTH = 254
 
@@ -108,7 +108,7 @@ class SetPasswordFormTestCase(FormsTestCase):
 
     def test_mismatch(self):
         data_sets = [
-            FormDataSet({'new_password': 'mellon12', 'new_password_repeat': 'mellon13'},
+            FormDataSet({'new_password': 'mellonAB12+-', 'new_password_repeat': 'mellonAB13+-'},
                         [('new_password_repeat', 'password_mismatch')]),
         ]
         super(SetPasswordFormTestCase, self).test_invalid_data(data_sets=data_sets, form_kwargs={'user': self.user})
@@ -150,9 +150,10 @@ class SetPasswordFormTestCase(FormsTestCase):
 
     def test_valid(self):
         data_sets = [
-            FormDataSet({'new_password': 'mellon12', 'new_password_repeat': 'mellon12'}),
-            FormDataSet({'new_password': 'mellon12', 'new_password_repeat': 'mellon12', 'send_password_mail': True}),
-            FormDataSet({'new_password': u'"ä§ Mellon12', 'new_password_repeat': u'"ä§ Mellon12'}),
+            FormDataSet({'new_password': 'mellonAB12+-', 'new_password_repeat': 'mellonAB12+-'}),
+            FormDataSet({'new_password': 'mellonAB12+-', 'new_password_repeat': 'mellonAB12+-',
+                         'send_password_mail': True}),
+            FormDataSet({'new_password': u'"ä§ MellonAB12+-', 'new_password_repeat': u'"ä§ MellonAB12+-'}),
             FormDataSet({'new_password': 'mellon12' * 128, 'new_password_repeat': 'mellon12' * 128}),
         ]
         super(SetPasswordFormTestCase, self).test_valid_data(data_sets=data_sets, form_kwargs={'user': self.user})
diff --git a/dav_auth/tests/test_screenshots.py b/dav_auth/tests/test_screenshots.py
index 70e38fd..7ab5aee 100644
--- a/dav_auth/tests/test_screenshots.py
+++ b/dav_auth/tests/test_screenshots.py
@@ -9,7 +9,7 @@ from selenium.webdriver.common.keys import Keys
 from dav_base.tests.generic import ScreenshotTestCase
 
 TEST_USERNAME = 'root@localhost'
-TEST_PASSWORD = u'me||ön 2'
+TEST_PASSWORD = u'me||ön 21ABll'
 TEST_EMAIL = TEST_USERNAME
 
 
diff --git a/dav_auth/tests/test_templates.py b/dav_auth/tests/test_templates.py
index c140bfd..ebd1c66 100644
--- a/dav_auth/tests/test_templates.py
+++ b/dav_auth/tests/test_templates.py
@@ -12,7 +12,7 @@ from dav_base.tests.generic import SeleniumTestCase
 from .generic import SeleniumAuthMixin
 
 TEST_USERNAME = 'root@localhost'
-TEST_PASSWORD = 'me||ön 2'
+TEST_PASSWORD = 'me||ön 21ABll'
 TEST_EMAIL = TEST_USERNAME
 
 
diff --git a/dav_auth/tests/test_validators.py b/dav_auth/tests/test_validators.py
index faff32e..62918fc 100644
--- a/dav_auth/tests/test_validators.py
+++ b/dav_auth/tests/test_validators.py
@@ -83,22 +83,22 @@ class CustomWordlistPasswordValidatorTestCase(SimpleTestCase):
     def test_invalid(self):
         invalid_passwords = [
             (u'passwort', [
-                u'The password must not contain the word \'passwort\'',
+                u'Das Passwort darf nicht die Zeichenfolge \'passwort\' enthalten.',
             ]),
             (u'abcdDaVefgh', [
-                u'The password must not contain the word \'dav\'',
+                u'Das Passwort darf nicht die Zeichenfolge \'dav\' enthalten.',
             ]),
             (u'abcdsektIonefgh', [
-                u'The password must not contain the word \'sektion\'',
+                u'Das Passwort darf nicht die Zeichenfolge \'sektion\' enthalten.',
             ]),
             (u'alpen12verein34KArlsruhE  berge', [
-                u'The password must not contain the word \'karlsruhe\'',
-                u'The password must not contain the word \'berge\'',
+                u'Das Passwort darf nicht die Zeichenfolge \'karlsruhe\' enthalten.',
+                u'Das Passwort darf nicht die Zeichenfolge \'berge\' enthalten.',
             ]),
             (u'heinzel@alpenverein-karlsruhe.de', [
-                u'The password must not contain the word \'heinzel\'',
-                u'The password must not contain the word \'alpenverein\'',
-                u'The password must not contain the word \'karlsruhe\'',
+                u'Das Passwort darf nicht die Zeichenfolge \'heinzel\' enthalten.',
+                u'Das Passwort darf nicht die Zeichenfolge \'alpenverein\' enthalten.',
+                u'Das Passwort darf nicht die Zeichenfolge \'karlsruhe\' enthalten.',
             ]),
         ]
 
@@ -140,66 +140,66 @@ class CharacterClassPasswordValidatorTestCase(SimpleTestCase):
     def test_invalid(self):
         invalid_passwords = [
             (u'', [
-                u'The password must contain at least 2 characters from a-z',
-                u'The password must contain at least 2 characters from A-Z',
-                u'The password must contain at least 2 digits from 0-9',
-                u'The password must contain at least 2 non alpha numeric characters',
+                u'Das Passwort muss mindestens 2 Kleinbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Großbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Ziffern enthalten.',
+                u'Das Passwort muss mindestens 2 Sonderzeichen enthalten.',
             ]),
             (u'A+-', [
-                u'The password must contain at least 2 characters from a-z',
-                u'The password must contain at least 2 characters from A-Z',
-                u'The password must contain at least 2 digits from 0-9',
+                u'Das Passwort muss mindestens 2 Kleinbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Großbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Ziffern enthalten.',
             ]),
             (u'1234567890*', [
-                u'The password must contain at least 2 characters from a-z',
-                u'The password must contain at least 2 characters from A-Z',
-                u'The password must contain at least 2 non alpha numeric characters',
+                u'Das Passwort muss mindestens 2 Kleinbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Großbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Sonderzeichen enthalten.',
             ]),
             (u'34*/()', [
-                u'The password must contain at least 2 characters from a-z',
-                u'The password must contain at least 2 characters from A-Z',
+                u'Das Passwort muss mindestens 2 Kleinbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Großbuchstaben enthalten.',
             ]),
             (u'AA', [
-                u'The password must contain at least 2 characters from a-z',
-                u'The password must contain at least 2 digits from 0-9',
-                u'The password must contain at least 2 non alpha numeric characters',
+                u'Das Passwort muss mindestens 2 Kleinbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Ziffern enthalten.',
+                u'Das Passwort muss mindestens 2 Sonderzeichen enthalten.',
             ]),
             (u'CD0.,', [
-                u'The password must contain at least 2 characters from a-z',
-                u'The password must contain at least 2 digits from 0-9',
+                u'Das Passwort muss mindestens 2 Kleinbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Ziffern enthalten.',
             ]),
             (u'EF56', [
-                u'The password must contain at least 2 characters from a-z',
-                u'The password must contain at least 2 non alpha numeric characters',
+                u'Das Passwort muss mindestens 2 Kleinbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Sonderzeichen enthalten.',
             ]),
             (u'8GH?!8', [
-                u'The password must contain at least 2 characters from a-z',
+                u'Das Passwort muss mindestens 2 Kleinbuchstaben enthalten.',
             ]),
             (u'bbX', [
-                u'The password must contain at least 2 characters from A-Z',
-                u'The password must contain at least 2 digits from 0-9',
-                u'The password must contain at least 2 non alpha numeric characters',
+                u'Das Passwort muss mindestens 2 Großbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Ziffern enthalten.',
+                u'Das Passwort muss mindestens 2 Sonderzeichen enthalten.',
             ]),
             (u'$cd%', [
-                u'The password must contain at least 2 characters from A-Z',
-                u'The password must contain at least 2 digits from 0-9',
+                u'Das Passwort muss mindestens 2 Großbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Ziffern enthalten.',
             ]),
             (u'ef90', [
-                u'The password must contain at least 2 characters from A-Z',
-                u'The password must contain at least 2 non alpha numeric characters',
+                u'Das Passwort muss mindestens 2 Großbuchstaben enthalten.',
+                u'Das Passwort muss mindestens 2 Sonderzeichen enthalten.',
             ]),
             (u'1g=h3~', [
-                u'The password must contain at least 2 characters from A-Z',
+                u'Das Passwort muss mindestens 2 Großbuchstaben enthalten.',
             ]),
             (u'Gi&jH', [
-                u'The password must contain at least 2 digits from 0-9',
-                u'The password must contain at least 2 non alpha numeric characters',
+                u'Das Passwort muss mindestens 2 Ziffern enthalten.',
+                u'Das Passwort muss mindestens 2 Sonderzeichen enthalten.',
             ]),
             (u'IkK:i;', [
-                u'The password must contain at least 2 digits from 0-9',
+                u'Das Passwort muss mindestens 2 Ziffern enthalten.',
             ]),
             (u'mKn4L8', [
-                u'The password must contain at least 2 non alpha numeric characters',
+                u'Das Passwort muss mindestens 2 Sonderzeichen enthalten.',
             ]),
         ]
 
diff --git a/dav_auth/tests/test_views.py b/dav_auth/tests/test_views.py
index 404650f..28a1ee0 100644
--- a/dav_auth/tests/test_views.py
+++ b/dav_auth/tests/test_views.py
@@ -10,7 +10,7 @@ from django.urls import reverse
 from ..forms import LoginForm, SetPasswordForm, CreateAndSendPasswordForm
 
 TEST_USERNAME = 'root@localhost'
-TEST_PASSWORD = u'me||ön 2'
+TEST_PASSWORD = u'me||ön 21ABll'
 TEST_EMAIL = TEST_USERNAME
 
 
diff --git a/dav_auth/validators.py b/dav_auth/validators.py
index f1c4ba6..481eea4 100644
--- a/dav_auth/validators.py
+++ b/dav_auth/validators.py
@@ -56,15 +56,15 @@ class PasswordScoreValidator(object):
         score, used_classes = self._get_score(password, user=user)
 
         if used_classes < self.min_classes:
-            raise ValidationError(_(u'The password must contain characters from at least %(min_classes)d'
-                                    u' different character classes (i.e. lower, upper, digits, others).'),
+            raise ValidationError(_(u'Das Passwort muss Zeichen aus mindestens %(min_classes)d'
+                                    u' verschiedenen Arten von Zeichen bestehen'
+                                    u' (d.h. Kleinbuchstaben, Großbuchstaben, Ziffern und Sonderzeichen).'),
                                   code='too_few_classes',
                                   params={'min_classes': self.min_classes})
 
         if score < self.min_score:
-            raise ValidationError(_(u'The password is too simple. Use more characters'
-                                    u' and maybe use more different character classes'
-                                    u' (i.e. lower, upper, digits, others).'),
+            raise ValidationError(_(u'Dieses Passwort ist zu einfach. Benutze mehr Zeichen'
+                                    u' und gegebenenfalls auch Großbuchstaben, Ziffern und Sonderzeichen.'),
                                   code='too_little_score')
 
         return score
@@ -116,7 +116,7 @@ class CustomWordlistPasswordValidator(object):
         lower_pw = password.lower()
         for word in self.words:
             if word in lower_pw:
-                error = ValidationError(_(u'The password must not contain the word \'%(word)s\''),
+                error = ValidationError(_(u'Das Passwort darf nicht die Zeichenfolge \'%(word)s\' enthalten.'),
                                         code='forbidden_word',
                                         params={'word': word})
                 errors.append(error)
@@ -166,23 +166,23 @@ class CharacterClassPasswordValidator(object):
     def validate(self, password, user=None):
         errors = []
         if not self._is_enough_lower(password):
-            error = ValidationError(_(u'The password must contain at least %(min_lower)d characters from a-z'),
+            error = ValidationError(_(u'Das Passwort muss mindestens %(min_lower)d Kleinbuchstaben enthalten.'),
                                     code='too_few_lower_characters',
                                     params={'min_lower': self.minimum_lower})
             errors.append(error)
         if not self._is_enough_upper(password):
-            error = ValidationError(_(u'The password must contain at least %(min_upper)d characters from A-Z'),
+            error = ValidationError(_(u'Das Passwort muss mindestens %(min_upper)d Großbuchstaben enthalten.'),
                                     code='too_few_upper_characters',
                                     params={'min_upper': self.minimum_upper})
             errors.append(error)
         if not self._is_enough_digits(password):
-            error = ValidationError(_(u'The password must contain at least %(min_digits)d digits from 0-9'),
+            error = ValidationError(_(u'Das Passwort muss mindestens %(min_digits)d Ziffern enthalten.'),
                                     code='too_few_digits',
                                     params={'min_digits': self.minimum_digits})
             errors.append(error)
         if not self._is_enough_others(password):
-            error = ValidationError(_(u'The password must contain at least %(min_others)d'
-                                      u' non alpha numeric characters'),
+            error = ValidationError(_(u'Das Passwort muss mindestens %(min_others)d'
+                                      u' Sonderzeichen enthalten.'),
                                     code='too_few_other_characters',
                                     params={'min_others': self.minimum_others})
             errors.append(error)
diff --git a/dav_auth/views.py b/dav_auth/views.py
index 995c8f5..fcf30ec 100644
--- a/dav_auth/views.py
+++ b/dav_auth/views.py
@@ -1,3 +1,4 @@
+# -*- coding: utf-8 -*-
 import logging
 from django.apps import apps
 from django.core.exceptions import ValidationError
@@ -7,6 +8,7 @@ from django.contrib.auth.password_validation import validate_password
 from django.http import HttpResponseRedirect
 from django.shortcuts import resolve_url
 from django.urls import reverse_lazy, reverse
+from django.utils.safestring import mark_safe
 from django.utils.translation import ugettext as _
 from django.views import generic
 
@@ -29,11 +31,19 @@ class LoginView(auth_views.LoginView):
 
     def form_valid(self, form):
         r = super(LoginView, self).form_valid(form)
+        messages.success(self.request, _(u'Benutzer angemeldet: %(username)s') % {'username': form.get_user()})
         try:
             validate_password(form.cleaned_data['password'])
         except ValidationError as e:
             logger.warning(u'Weak password (%d): %s', self.request.user.pk, e)
-        messages.success(self.request, _(u'Benutzer angemeldet: %(username)s') % {'username': form.get_user()})
+            message = u'<br />\n<p>\n'
+            message += u'Dein Passwort entspricht nicht mehr den aktuellen Passwortrichtlinien.<br />\n'
+            message += u'Bitte hilf uns die Daten deiner Teilnehmer zu schützen und ändere dein Passwort.<br />\n'
+            message += u'</p>\n'
+            message += u'<p>\n'
+            message += u'<a href="%(href)s">Passwort ändern</a>\n' % {'href': reverse('dav_auth:set_password')}
+            message += u'</p>\n<br />\n'
+            messages.warning(self.request, mark_safe(message))
         return r
 
 
@@ -76,7 +86,7 @@ class CreateAndSendPasswordView(generic.FormView):
         user_model = get_user_model()
         try:
             user = user_model.objects.get(username=username)
-            random_password = user_model.objects.make_random_password(length=12)
+            random_password = user_model.objects.make_random_password(length=32)
             user.set_password(random_password)
             user.save()
             email = emails.PasswordSetEmail(user, random_password)
diff --git a/dav_base/console_scripts/django_project_config/additional_settings.py b/dav_base/console_scripts/django_project_config/additional_settings.py
index e85977f..470bb04 100644
--- a/dav_base/console_scripts/django_project_config/additional_settings.py
+++ b/dav_base/console_scripts/django_project_config/additional_settings.py
@@ -52,6 +52,30 @@ DATABASES['default'] = {
     'NAME': os.path.join(BASE_VAR_DIR, 'db', 'devel.sqlite3'),
 }
 
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
+        'OPTIONS': {
+            'min_length': 12,
+        },
+    },
+    {
+        'NAME': 'dav_auth.validators.PasswordScoreValidator',
+    },
+    {
+        'NAME': 'dav_auth.validators.CustomWordlistPasswordValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
+    },
+]
+
 STATIC_ROOT = os.path.join(BASE_VAR_DIR, 'www', 'static')
 
 LANGUAGE_CODE = 'de'
diff --git a/dav_events/tests/test_screenshots.py b/dav_events/tests/test_screenshots.py
index f0246ab..a211883 100644
--- a/dav_events/tests/test_screenshots.py
+++ b/dav_events/tests/test_screenshots.py
@@ -14,7 +14,7 @@ from dav_auth.tests.generic import SeleniumAuthMixin
 from .generic import RoleMixin
 
 TEST_TRAINER_EMAIL = 'trainer@localhost'
-TEST_PASSWORD = u'me||ön 2'
+TEST_PASSWORD = u'me||ön 21ABll'
 TEST_EVENT_DATA_S = {
     'mode': 'training',
     'sport': 'S',