From 6683eceda50da609d16b2460ac2777b462e0eabd Mon Sep 17 00:00:00 2001
From: Laurent Jouanneau <dev@ljouanneau.com>
Date: Tue, 5 Sep 2023 16:11:00 +0200
Subject: [PATCH 1/5] Passwords: increase minimum length to 12 characters

---
 lizmap/app/overloads/jcommunity/forms/registration.form.xml | 2 +-
 lizmap/modules/lizmap/forms/account_admin.form.xml          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lizmap/app/overloads/jcommunity/forms/registration.form.xml b/lizmap/app/overloads/jcommunity/forms/registration.form.xml
index 25ea72e0ee..83395e735c 100644
--- a/lizmap/app/overloads/jcommunity/forms/registration.form.xml
+++ b/lizmap/app/overloads/jcommunity/forms/registration.form.xml
@@ -29,7 +29,7 @@
         <label locale="view~user.form.organization.label"/>
     </input>
 
-    <secret ref="reg_password"  required="true" minlength="8" maxlength="120">
+    <secret ref="reg_password"  required="true" minlength="12" maxlength="120">
         <label locale="jcommunity~account.form.password"/>
         <help locale="jcommunity~account.form.password.help"/>
         <confirm locale="jcommunity~account.form.password.confirm" />
diff --git a/lizmap/modules/lizmap/forms/account_admin.form.xml b/lizmap/modules/lizmap/forms/account_admin.form.xml
index ab5ccce289..949270461a 100644
--- a/lizmap/modules/lizmap/forms/account_admin.form.xml
+++ b/lizmap/modules/lizmap/forms/account_admin.form.xml
@@ -14,7 +14,7 @@
         <label locale="jcommunity~account.form.email"/>
     </input>
 
-    <secret ref="password" minlength="8" maxlength="120">
+    <secret ref="password" minlength="12" maxlength="120">
         <label locale="jcommunity~account.form.password"/>
         <help locale="jcommunity~account.form.password.help"/>
         <confirm locale="jcommunity~account.form.password.confirm"/>

From 03660e3a5c22c6a36c684debecd7688696aad8b6 Mon Sep 17 00:00:00 2001
From: Laurent Jouanneau <dev@ljouanneau.com>
Date: Tue, 5 Sep 2023 16:12:33 +0200
Subject: [PATCH 2/5] Logins: increase the field to 255 characters

It allows to use email as login.
The increase of the field into the database is made by
the jcommunity module 1.4.0-beta.1.
---
 lizmap/app/overloads/jcommunity/forms/registration.form.xml | 4 ++--
 lizmap/composer.json                                        | 4 ++--
 lizmap/modules/lizmap/daos/user.dao.xml                     | 2 +-
 lizmap/modules/lizmap/forms/account_admin.form.xml          | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lizmap/app/overloads/jcommunity/forms/registration.form.xml b/lizmap/app/overloads/jcommunity/forms/registration.form.xml
index 83395e735c..a8f567aee8 100644
--- a/lizmap/app/overloads/jcommunity/forms/registration.form.xml
+++ b/lizmap/app/overloads/jcommunity/forms/registration.form.xml
@@ -9,11 +9,11 @@
     @link         http://jelix.org
     @licence      http://www.gnu.org/licenses/gpl.html GNU General Public Licence, see LICENCE file
     -->
-    <input ref="reg_login" required="true">
+    <input ref="reg_login" required="true" minlength="3" maxlength="255">
         <label locale="jcommunity~account.form.login"/>
     </input>
 
-    <input ref="reg_email"  required="true" type="email">
+    <input ref="reg_email"  required="true" type="email" maxlength="255">
         <label locale="jcommunity~account.form.email"/>
     </input>
 
diff --git a/lizmap/composer.json b/lizmap/composer.json
index 3a8ba9e9ed..881b78ccf0 100644
--- a/lizmap/composer.json
+++ b/lizmap/composer.json
@@ -7,9 +7,9 @@
   ],
   "require": {
     "php": ">=7.4",
-    "jelix/jelix": "~1.8.2",
+    "jelix/jelix": "dev-jelix-1.8.x",
     "jelix/composer-module-setup": "^1.0.6",
-    "jelix/jcommunity-module": "~1.3.20",
+    "jelix/jcommunity-module": "1.4.0-beta.1",
     "jelix/ldapdao-module": "~2.2.4",
     "proj4php/proj4php": "dev-proj4php5.2",
     "violet/streaming-json-encoder": "^1.1.5",
diff --git a/lizmap/modules/lizmap/daos/user.dao.xml b/lizmap/modules/lizmap/daos/user.dao.xml
index ad90c32c5d..30e2b7f3e3 100644
--- a/lizmap/modules/lizmap/daos/user.dao.xml
+++ b/lizmap/modules/lizmap/daos/user.dao.xml
@@ -5,7 +5,7 @@
     </datasources>
     <record>
         <property name="login" fieldname="usr_login"
-                  required="yes" datatype="string"  maxlength="50" />
+                  required="yes" datatype="string"  maxlength="255" />
 
         <property name="email" fieldname="usr_email"
                   datatype="string" required="yes" maxlength="255" />
diff --git a/lizmap/modules/lizmap/forms/account_admin.form.xml b/lizmap/modules/lizmap/forms/account_admin.form.xml
index 949270461a..2c99e97421 100644
--- a/lizmap/modules/lizmap/forms/account_admin.form.xml
+++ b/lizmap/modules/lizmap/forms/account_admin.form.xml
@@ -6,7 +6,7 @@
      -->
 
 
-    <input ref="login" required="true" minlength="3" maxlength="50">
+    <input ref="login" required="true" minlength="3" maxlength="255">
         <label locale="jcommunity~account.form.login"/>
     </input>
 

From 954b1c25b12626189dbc9cbef1aad2388d12b5f5 Mon Sep 17 00:00:00 2001
From: Laurent Jouanneau <dev@ljouanneau.com>
Date: Wed, 13 Sep 2023 15:28:20 +0200
Subject: [PATCH 3/5] User admins: the account creation date should be humain
 readable

---
 lizmap/modules/lizmap/forms/account_admin.form.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lizmap/modules/lizmap/forms/account_admin.form.xml b/lizmap/modules/lizmap/forms/account_admin.form.xml
index 2c99e97421..555bca89a9 100644
--- a/lizmap/modules/lizmap/forms/account_admin.form.xml
+++ b/lizmap/modules/lizmap/forms/account_admin.form.xml
@@ -70,11 +70,11 @@
         <label locale="jcommunity~account.form.keyactivate"/>
     </output>
 
-    <output ref="request_date">
+    <output ref="request_date" type="localedatetime">
         <label locale="jcommunity~account.form.requestdate"/>
     </output>
 
-    <output ref="create_date">
+    <output ref="create_date" type="localedatetime">
         <label locale="jcommunity~account.form.createdate"/>
     </output>
 

From ca9270be476f42ea1bb0d6dcab532d2d4b2ba854 Mon Sep 17 00:00:00 2001
From: Laurent Jouanneau <dev@ljouanneau.com>
Date: Wed, 20 Sep 2023 12:36:11 +0200
Subject: [PATCH 4/5] Remove the unused jauthdb_admin password_change template

It is not needed since we are using jCommunity
---
 .../default/jauthdb_admin/password_change.tpl | 49 -------------------
 1 file changed, 49 deletions(-)
 delete mode 100644 lizmap/app/themes/default/jauthdb_admin/password_change.tpl

diff --git a/lizmap/app/themes/default/jauthdb_admin/password_change.tpl b/lizmap/app/themes/default/jauthdb_admin/password_change.tpl
deleted file mode 100644
index df2919f6fb..0000000000
--- a/lizmap/app/themes/default/jauthdb_admin/password_change.tpl
+++ /dev/null
@@ -1,49 +0,0 @@
-{if $personalview}
-<h1>{@jauthdb_admin~user.title.password@}</h1>
-{else}
-<h1>{@jauthdb_admin~crud.title.password@} {$id}</h1>
-{/if}
-<script>
-//<![CDATA[
-{literal}
-function verifpass() {
-	var pwd = document.getElementById('pwd').value;
-	var pwd2 = document.getElementById('pwd_confirm').value;
-	if ( pwd == '' || pwd != pwd2) {
-{/literal}
-		alert("{@jauthdb_admin~crud.message.bad.password@}");
-		return false;
-{literal}
-	}
-	else return true;
-{/literal}
-}
-//]]>
-</script>
-<form action="{formurl 'password:update', array('j_user_login'=>$id)}" class="form-horizontal" method="post"
-onsubmit="return verifpass()">
-	<fieldset><legend>{@jauthdb_admin~crud.form.new.password@}</legend>
-	{formurlparam 'password:update', array('j_user_login'=>$id)}
-	
-	<div class="control-group">
-  <label class="control-label" for="pwd">{@jauthdb_admin~crud.form.password@}</label>
-  <div class="controls">
-	<input type="password" id="pwd" name="pwd" />
-	<span class="help-block">({@jauthdb_admin~crud.form.random.password@} {$randomPwd})</span>
-  </div>
-	</div>
-
-	<div class="control-group">
-  <label class="control-label" for="pwd_confirm">{@jauthdb_admin~crud.form.password.confirm@}</label>
-  <div class="controls">
-	<input type="password" id="pwd_confirm" name="pwd_confirm" />
-  </div>
-	</div>
-	
-	<div class="form-actions">
-	<input type="submit" value="{@jauthdb_admin~crud.form.submit@}" class="btn"/>
-	</div>
-	</fieldset>
-</form>
-
-<p><a href="{jurl $viewaction, array('j_user_login'=>$id)}" class="crud-link btn">{if $personalview}{@jauthdb_admin~crud.link.return.to.view@}{else}{@jauthdb_admin~user.link.return.to.view@}{/if}</a></p>

From 75174c83c8255233814798bd19f0fab2edf3886d Mon Sep 17 00:00:00 2001
From: Laurent Jouanneau <dev@ljouanneau.com>
Date: Wed, 20 Sep 2023 12:45:04 +0200
Subject: [PATCH 5/5] Update changelog

---
 CHANGELOG-3.6.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG-3.6.md b/CHANGELOG-3.6.md
index fc4c7c52e8..8e2fe8d7b7 100644
--- a/CHANGELOG-3.6.md
+++ b/CHANGELOG-3.6.md
@@ -19,6 +19,8 @@ with some extra keywords : backend, tests, test, translation, funders, important
 * Fix some grammar
 * Allow import/export in selection tool
 * Fix 500 error in the administration panel when the "Lizmap server" plugin was not found
+* Fix increase the login length in the database in order to use email as logins
+* the minimal length of password is now 12 characters to improve the security
 
 ### Translations