Wikimedia Bugzilla is closed!

While doing some hacking on the system for allowing users to change their passwords, I noticed that the default value for $wgMinimalPasswordLength seems to be zero.

$wgMinimalPasswordLength is used in function savePreferences() in SpecialPreferences.php. When someone tries to change their password using Special:Preferences, it compares the new password length against $wgMinimalPasswordLength and returns an error message if the new password is shorter.

A value of 0 for $wgMinimalPasswordLength would therefore seem to mean that users can set their password to the empty string if they wish. As an experiment, I tried changing my password to an empty string. When I hit submit, Special:Preferences responded, "Your preferences have been saved." In fact, however, my password remained unchanged.

I'm not sure how this should be changed. I would recommend having a default value greater than zero for $wgMinimalPasswordLength for MediaWiki upon installation. There may be cases where some MediaWiki sites want to allow empty strings as user passwords, but this should not be the default.

In any case, the message from Special:Preferences is currently confusing. It SEEMED to say that it had allowed me to change my password to an empty string, but it did not in fact allow this. The software should either allow empty strings as user passwords (in which case the current response of "Your preferences have been saved" is fine), or it should respond with a more accurate message such as "You cannot change your user password to an empty string."