Revert "Update password minimum/generated lengths to NTIS 2025 security guidelines"

This reverts commit 95c9d63.

Author: opengeek

core/src/Revolution/Processors/Security/Profile/ChangePassword.php

@@ -50,7 +50,7 @@ public function process()
 
         $password = $this->getProperty('password_new');
         if (!$this->getProperty('password_method_screen')) {
-            $length = (integer)$this->modx->getOption('password_min_length', null, 12);
+            $length = (integer)$this->modx->getOption('password_min_length', null, 8);
             $password = str_repeat('*', mt_rand($length, strlen($this->getProperty('password_new')) * 2));
         }
 
@@ -68,7 +68,7 @@ public function validate()
             $this->addFieldError('password_old', $this->modx->lexicon('user_err_password_invalid_old'));
         }
 
-        if (empty($newPassword) || strlen($newPassword) < $this->modx->getOption('password_min_length', null, 12)) {
+        if (empty($newPassword) || strlen($newPassword) < $this->modx->getOption('password_min_length', null, 8)) {
             $this->addFieldError('password_new', $this->modx->lexicon('user_err_password_too_short'));
         } else {
             if (!preg_match('/^[^\'\x3c\x3e\(\);\x22\x7b\x7d\x2f\x5c]+$/', $newPassword)) {

core/src/Revolution/Processors/Security/Profile/Update.php

@@ -117,7 +117,7 @@ public function validate()
             if (!$this->modx->user->passwordMatches($oldPassword)) {
                 $this->addFieldError('password_old', $this->modx->lexicon('user_err_password_invalid_old'));
             }
-            if (empty($newPassword) || strlen($newPassword) < $this->modx->getOption('password_min_length', null, 12)) {
+            if (empty($newPassword) || strlen($newPassword) < $this->modx->getOption('password_min_length', null, 8)) {
                 $this->addFieldError('password_new', $this->modx->lexicon('user_err_password_too_short'));
             } elseif (!preg_match('/^[^\'\x3c\x3e\(\);\x22\x7b\x7d\x2f\x5c]+$/', $newPassword)) {
                 $this->addFieldError('password_new', $this->modx->lexicon('user_err_password_invalid'));

core/src/Revolution/Processors/Security/User/Validation.php

@@ -101,7 +101,7 @@ public function checkPassword()
                     $this->processor->addFieldError('specifiedpassword', $this->modx->lexicon('user_err_not_specified_password'));
                 } elseif ($specifiedPassword != $confirmPassword) {
                     $this->processor->addFieldError('confirmpassword', $this->modx->lexicon('user_err_password_no_match'));
-                } elseif (strlen($specifiedPassword) < $this->modx->getOption('password_min_length', null, 12, true)) {
+                } elseif (strlen($specifiedPassword) < $this->modx->getOption('password_min_length', null, 8, true)) {
                     $this->processor->addFieldError('specifiedpassword', $this->modx->lexicon('user_err_password_too_short'));
                 } elseif (!preg_match('/^[^\'\x3c\x3e\(\);\x22\x7b\x7d\x2f\x5c]+$/', $specifiedPassword)) {
                     $this->processor->addFieldError('specifiedpassword', $this->modx->lexicon('user_err_password_invalid'));

core/src/Revolution/modUser.php

@@ -897,10 +897,10 @@ public function removeLocks(array $options = [])
     public function generatePassword($length = null, array $options = [])
     {
         if ($length === null) {
-            $length = (int)$this->xpdo->getOption('password_generated_length', null, 16, true);
+            $length = (int)$this->xpdo->getOption('password_generated_length', null, 10, true);
         }
 
-        $passwordMinimumLength = (int)$this->xpdo->getOption('password_min_length', null, 12, true);
+        $passwordMinimumLength = (int)$this->xpdo->getOption('password_min_length', null, 8, true);
         if ($length < $passwordMinimumLength) {
             $length = $passwordMinimumLength;
         }