OXDEV-9216 Fix password constraints usage

Author: NikolaIvanovski

CHANGELOG.md

@@ -12,6 +12,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Honeypot Captcha to detect and block bots without disrupting user experience.
 - Support of PHP 8.4
 
+### Fixed
+- Password validators are no longer used when password policy is disabled
+
 ## [1.0.0] - 2024-11-27
 This is the stable release of v1.0.0. No changes have been made since v1.0.0-rc.1.
 

src/Shared/Core/InputValidator.php

@@ -29,7 +29,7 @@ public function checkPassword($user, $newPassword, $confirmationPassword, $shoul
     {
         $settingsService = $this->getService(ModuleSettingsServiceInterface::class);
         if (!$settingsService->isPasswordPolicyEnabled()) {
-            parent::checkPassword($user, $newPassword, $confirmationPassword, $shouldCheckPasswordLength);
+            return parent::checkPassword($user, $newPassword, $confirmationPassword, $shouldCheckPasswordLength);
         }
 
         $passwordValidator = $this->getService(PasswordValidatorChainInterface::class);

tests/Integration/Shared/Core/InputValidatorTest.php

@@ -13,7 +13,9 @@
 use OxidEsales\Eshop\Core\Exception\InputException;
 use OxidEsales\Eshop\Core\Exception\UserException;
 use OxidEsales\Eshop\Core\Registry;
+use OxidEsales\EshopCommunity\Internal\Container\ContainerFactory;
 use OxidEsales\EshopCommunity\Tests\Integration\IntegrationTestCase;
+use OxidEsales\SecurityModule\PasswordPolicy\Service\ModuleSettingsServiceInterface;
 use OxidEsales\SecurityModule\Shared\Core\InputValidator;
 use PHPUnit\Framework\Attributes\DataProvider;
 
@@ -22,6 +24,8 @@ class InputValidatorTest extends IntegrationTestCase
     #[DataProvider('dataProviderPasswordError')]
     public function testInputValidationError($password, $expectedException): void
     {
+        $this->setPasswordState(true);
+
         $userModelMock = $this->createMock(User::class);
 
         $validator = oxNew(InputValidator::class);
@@ -86,4 +90,26 @@ public function testShopPasswordCheck(): void
             $exception->getMessage()
         );
     }
+
+    public function testInputValidatorPasswordConstrainsAreSkipped(): void
+    {
+        $this->setPasswordState();
+
+        $userModelMock = $this->createMock(User::class);
+
+        $password = '12345678';
+
+        $validator = oxNew(InputValidator::class);
+        $result = $validator->checkPassword($userModelMock, $password, $password);
+
+        $this->assertNull($result);
+    }
+
+    private function setPasswordState(bool $state = false)
+    {
+        return ContainerFactory::getInstance()
+            ->getContainer()
+            ->get(ModuleSettingsServiceInterface::class)
+            ->saveIsPasswordPolicyEnabled($state);
+    }
 }