dolibarr/htdocs/core/modules/security/generate
Frédéric FRANCE 750145e663
NEW: #0 Resolve password generator/validator classes via modules_parts['models'] (#39486)
Password generator/validator classes (USER_PASSWORD_GENERATED,
modGeneratePassXxx extends ModeleGenPassword) could previously only live
under htdocs/core/modules/security/generate/ — every call site resolving
one by name hardcoded that path, so no third-party module could
contribute its own generator without patching core.

Reuse the modules_parts['models'] extension point already populated for
any enabled module declaring $this->module_parts['models'] = 1 (the same
mechanism every numbering-module scan in Dolibarr already uses — see e.g.
Facture::getNextNumRef()), and wire it into the password-generator scan
too:

- admin/security.php's generator listing now scans core plus every
  enabled module declaring module_parts['models'], instead of only
  core/modules/security/generate/.
- Added ModeleGenPassword::loadAndInstantiate($id, ...) in
  modules_genpassword.php, a shared factory doing that same multi-root
  resolution once, used by the four runtime call sites that previously
  hardcoded the core-only path: User::setPassword(), getRandomPassword()
  (security2.lib.php), FormSetupItem::generateInputFieldPassword()
  (html.formsetup.class.php), and PasswordField::verifyFieldValue()
  (passwordfield.class.php). getRandomPassword() falls back to the
  'standard' generator (with a warning logged) if the configured
  generator's class can't be resolved, rather than silently generating
  and persisting an empty password.

Behavior for the built-in Standard/None/Perso generators is unchanged —
core is always the first root scanned, so it always wins for those ids.
2026-08-14 16:19:48 +02:00
..
modGeneratePassNone.class.php Add log 2025-01-14 10:35:44 +01:00
modGeneratePassPerso.class.php Replace all str_shuffle functions with a Fisher-Yate 2026-06-06 16:17:23 +02:00
modGeneratePassStandard.class.php Add log 2025-01-14 10:35:44 +01:00
modules_genpassword.php NEW: #0 Resolve password generator/validator classes via modules_parts['models'] (#39486) 2026-08-14 16:19:48 +02:00
README

README (english)
------------------------------------
Adding your own password generator module
------------------------------------


If you want to add your own password generator module. This is steps to follow to add your own password generator:


***** STEP 1 *****

Copy file
htdocs/core/modules/security/generate/modGeneratePassNone.class.php
into
htdocs/core/modules/security/generate/modGeneratePassMygenerator.class.php

You can choose value of your choice instead of "Mygenerator" in name of new file.


***** STEP 2 *****

Edit this file modGeneratePassMygenerator.class.php and change following text:

"class modGeneratePassNone"     into    "class modGeneratePassMygenerator"

Then add code inside the "getDecription" function.
Then add code inside the "getExample" function.
Then add code inside the "getNewGeneratedPassword" function.
Then add code inside the "validatePassword" function.


***** STEP 3 *****

Once this file has been edited, you can go to the Dolibarr security setup,
choose tab "passwords", you will see a new line generator in the "Rules to generate passwords" area.