is this a bug in pw's randomPass() method?

[bernhard]

Most of the time I'm getting a 3 digit password, but sometimes it is longer like here:

To copy&paste:

$pw = new Password();
d($pw->randomPass([
    'minLength' => 3,
    'maxLength' => 3,
    'minLower' => 0,
    'minUpper' => 0,
    'minDigits' => 0,
    'minSymbols' => 0,
    'maxSymbols' => -1,
]));

From core/Password.php:

	 * @param array $options Specify any of the following options (all optional):
	 *  - `minLength` (int): Minimum lenth of returned value (default=7).
	 *  - `maxLength` (int): Maximum lenth of returned value, will be exceeded if needed to meet other options (default=15).
	 *  - `minLower` (int): Minimum number of lowercase characters required (default=1). 
	 *  - `minUpper` (int): Minimum number of uppercase characters required (default=1).
	 *  - `maxUpper` (int): Maximum number of uppercase characters allowed (0=any, -1=none, default=3).
	 *  - `minDigits` (int): Minimum number of digits required (default=1).
	 *  - `maxDigits` (int): Maximum number of digits allowed (0=any, -1=none, default=0). 
	 *  - `minSymbols` (int): Minimum number of non-alpha, non-digit symbols required (default=0).
	 *  - `maxSymbols` (int): Maximum number of non-alpha, non-digit symbols to allow (0=any, -1=none, default=3).
	 *  - `useSymbols` (array): Array of characters to use as "symbols" in returned value (see method for default).
	 *  - `disallow` (array): Disallowed characters that may be confused with others (default=O,0,I,1,l).

Am I missing anything or shouldn't it always return a 3-digit password in this case?

[dragan]

I can imagine 3 is simply not long enough to guarantee randomness.

Perhaps that's why this is mentioned:

Quote

will be exceeded if needed to meet other options

 

[bernhard]

37 minutes ago, dragan said:

Perhaps that's why this is mentioned:

Quote

will be exceeded if needed to meet other options

As far as I understand this does only mean that if you had a setting 'minUppercase' => 2 and your initial random string would be aaa it would add 2 uppercase characters and result in aaaBB exceeding the maxLength setting.

But if I don't have any conflicting additional settings (which I think I do not have) it should always return a 3 digit string in my opinion.

[bernhard]

found another strange behaviour while testing my new RandomPageName module:

The string should actually have a length of 4 (not 5), the "minDigits" setting of 2 would also be true for "8y4k" so the final "x" is unnecessary (wrong) imho...