From 067f06b1660db7a6b29dddaf6896649474e27fff Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 1 Aug 2022 11:38:54 -0400
Subject: [PATCH 1/3] Rework return_path session key handling

- Add new IHandleSessions::pop() method
- Remove redirection from Authentication::setForUser()
- Add explicit return_path form parameter to Login::form()
---
 src/Core/Session.php                          |  5 +
 .../Session/Capability/IHandleSessions.php    | 10 ++
 src/Core/Session/Type/AbstractSession.php     | 14 +++
 src/Module/Security/Login.php                 | 98 +++++++++++--------
 src/Module/Security/OpenID.php                |  6 +-
 src/Module/Security/TwoFactor/Recovery.php    |  2 +
 src/Module/Security/TwoFactor/Trust.php       |  3 +-
 src/Security/Authentication.php               | 24 +++--
 8 files changed, 102 insertions(+), 60 deletions(-)

diff --git a/src/Core/Session.php b/src/Core/Session.php
index aa8de99d5c..059cd499c0 100644
--- a/src/Core/Session.php
+++ b/src/Core/Session.php
@@ -44,6 +44,11 @@ class Session
 		return DI::session()->get($name, $defaults);
 	}
 
+	public static function pop($name, $defaults = null)
+	{
+		return DI::session()->pop($name, $defaults);
+	}
+
 	public static function set($name, $value)
 	{
 		DI::session()->set($name, $value);
diff --git a/src/Core/Session/Capability/IHandleSessions.php b/src/Core/Session/Capability/IHandleSessions.php
index 98c46ad4d9..d0b649845b 100644
--- a/src/Core/Session/Capability/IHandleSessions.php
+++ b/src/Core/Session/Capability/IHandleSessions.php
@@ -54,6 +54,16 @@ interface IHandleSessions
 	 */
 	public function get(string $name, $defaults = null);
 
+	/**
+	 * Retrieves a value from the provided key if it exists and removes it from session
+	 *
+	 * @param string $name
+	 * @param mixed  $defaults
+	 *
+	 * @return mixed
+	 */
+	public function pop(string $name, $defaults = null);
+
 	/**
 	 * Sets a single session variable.
 	 * Overrides value of existing key.
diff --git a/src/Core/Session/Type/AbstractSession.php b/src/Core/Session/Type/AbstractSession.php
index a24b6e478e..0e2f884a32 100644
--- a/src/Core/Session/Type/AbstractSession.php
+++ b/src/Core/Session/Type/AbstractSession.php
@@ -52,6 +52,20 @@ class AbstractSession implements IHandleSessions
 		return $_SESSION[$name] ?? $defaults;
 	}
 
+	/**
+	 * {@inheritDoc}
+	 */
+	public function pop(string $name, $defaults = null)
+	{
+		$value = $defaults;
+		if ($this->exists($name)) {
+			$value = $this->get($name);
+			$this->remove($name);
+		}
+
+		return $value;
+	}
+
 	/**
 	 * {@inheritDoc}
 	 */
diff --git a/src/Module/Security/Login.php b/src/Module/Security/Login.php
index 080c3ef3ca..80320403a6 100644
--- a/src/Module/Security/Login.php
+++ b/src/Module/Security/Login.php
@@ -21,54 +21,76 @@
 
 namespace Friendica\Module\Security;
 
+use Friendica\App;
 use Friendica\BaseModule;
+use Friendica\Core\Config\Capability\IManageConfigValues;
 use Friendica\Core\Hook;
+use Friendica\Core\L10n;
 use Friendica\Core\Renderer;
-use Friendica\Core\Session;
+use Friendica\Core\Session\Capability\IHandleSessions;
 use Friendica\DI;
 use Friendica\Module\Register;
+use Friendica\Module\Response;
+use Friendica\Security\Authentication;
+use Friendica\Util\Profiler;
+use Psr\Log\LoggerInterface;
 
 /**
  * Login module
  */
 class Login extends BaseModule
 {
+	/** @var Authentication */
+	private $auth;
+
+	/** @var IManageConfigValues */
+	private $config;
+
+	/** @var IHandleSessions */
+	private $session;
+
+	public function __construct(Authentication $auth, IManageConfigValues $config, IHandleSessions $session, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, array $server, array $parameters = [])
+	{
+		parent::__construct($l10n, $baseUrl, $args, $logger, $profiler, $response, $server, $parameters);
+
+		$this->auth    = $auth;
+		$this->config  = $config;
+		$this->session = $session;
+	}
+
 	protected function content(array $request = []): string
 	{
-		$return_path = $_REQUEST['return_path'] ?? '' ;
+		$return_path = $request['return_path'] ?? $this->session->pop('return_path', '') ;
 
 		if (local_user()) {
-			DI::baseUrl()->redirect($return_path);
-		} elseif (!empty($return_path)) {
-			Session::set('return_path', $return_path);
+			$this->baseUrl->redirect($return_path);
 		}
 
-		return self::form(Session::get('return_path'), intval(DI::config()->get('config', 'register_policy')) !== \Friendica\Module\Register::CLOSED);
+		return self::form($return_path, intval($this->config->get('config', 'register_policy')) !== \Friendica\Module\Register::CLOSED);
 	}
 
 	protected function post(array $request = [])
 	{
-		$return_path = Session::get('return_path');
-		Session::clear();
-		Session::set('return_path', $return_path);
+		$this->session->clear();
 
 		// OpenId Login
 		if (
-			empty($_POST['password'])
-			&& (!empty($_POST['openid_url'])
-				|| !empty($_POST['username']))
+			empty($request['password'])
+			&& (!empty($request['openid_url'])
+				|| !empty($request['username']))
 		) {
-			$openid_url = trim(($_POST['openid_url'] ?? '') ?: $_POST['username']);
+			$openid_url = trim(($request['openid_url'] ?? '') ?: $request['username']);
 
-			DI::auth()->withOpenId($openid_url, !empty($_POST['remember']));
+			$this->auth->withOpenId($openid_url, !empty($request['remember']));
 		}
 
-		if (!empty($_POST['auth-params']) && $_POST['auth-params'] === 'login') {
-			DI::auth()->withPassword(
+		if (!empty($request['auth-params']) && $request['auth-params'] === 'login') {
+			$this->auth->withPassword(
 				DI::app(),
-				trim($_POST['username']),
-				trim($_POST['password']),
-				!empty($_POST['remember'])
+				trim($request['username']),
+				trim($request['password']),
+				!empty($request['remember']),
+				$request['return_path'] ?? ''
 			);
 		}
 	}
@@ -76,26 +98,23 @@ class Login extends BaseModule
 	/**
 	 * Wrapper for adding a login box.
 	 *
-	 * @param string $return_path  The path relative to the base the user should be sent
-	 *                             back to after login completes
-	 * @param bool   $register     If $register == true provide a registration link.
-	 *                             This will most always depend on the value of config.register_policy.
-	 * @param array  $hiddens      optional
+	 * @param string|null $return_path The path relative to the base the user should be sent back to after login completes.
+	 * @param bool        $register    If $register == true provide a registration link.
+	 *                                 This will almost always depend on the value of config.register_policy.
 	 *
 	 * @return string Returns the complete html for inserting into the page
 	 *
 	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
+	 * @throws \Friendica\Network\HTTPException\ServiceUnavailableException
 	 * @hooks 'login_hook' string $o
 	 */
-	public static function form($return_path = null, $register = false, $hiddens = [])
+	public static function form(string $return_path = null, bool $register = false): string
 	{
-		$o = '';
-
 		$noid = DI::config()->get('system', 'no_openid');
 
 		if ($noid) {
-			Session::remove('openid_identity');
-			Session::remove('openid_attributes');
+			DI::session()->remove('openid_identity');
+			DI::session()->remove('openid_attributes');
 		}
 
 		$reg = false;
@@ -107,10 +126,6 @@ class Login extends BaseModule
 			];
 		}
 
-		if (is_null($return_path)) {
-			$return_path = DI::args()->getQueryString();
-		}
-
 		if (local_user()) {
 			$tpl = Renderer::getMarkupTemplate('logout.tpl');
 		} else {
@@ -122,13 +137,12 @@ class Login extends BaseModule
 			);
 
 			$tpl = Renderer::getMarkupTemplate('login.tpl');
-			$_SESSION['return_path'] = $return_path;
 		}
 
-		if (!empty(Session::get('openid_identity'))) {
+		if (!empty(DI::session()->get('openid_identity'))) {
 			$openid_title = DI::l10n()->t('Your OpenID: ');
 			$openid_readonly = true;
-			$identity = Session::get('openid_identity');
+			$identity = DI::session()->get('openid_identity');
 			$username_desc = DI::l10n()->t('Please enter your username and password to add the OpenID to your existing account.');
 		} else {
 			$openid_title = DI::l10n()->t('Or login using OpenID: ');
@@ -137,7 +151,7 @@ class Login extends BaseModule
 			$username_desc = '';
 		}
 
-		$o .= Renderer::replaceMacros(
+		$o = Renderer::replaceMacros(
 			$tpl,
 			[
 				'$dest_url'     => DI::baseUrl()->get(true) . '/login',
@@ -151,7 +165,7 @@ class Login extends BaseModule
 				'$openid'       => !$noid,
 				'$lopenid'      => ['openid_url', $openid_title, $identity, '', $openid_readonly],
 
-				'$hiddens'      => $hiddens,
+				'$hiddens'      => ['return_path' => $return_path ?? DI::args()->getQueryString()],
 
 				'$register'     => $reg,
 
@@ -174,14 +188,14 @@ class Login extends BaseModule
 	/**
 	 * Get the URL to the register page and add OpenID parameters to it
 	 */
-	private static function getRegisterURL()
+	private static function getRegisterURL(): string
 	{
-		if (empty(Session::get('openid_identity'))) {
+		if (empty(DI::session()->get('openid_identity'))) {
 			return 'register';
 		}
 
 		$args = [];
-		$attr = Session::get('openid_attributes', []);
+		$attr = DI::session()->get('openid_attributes', []);
 
 		if (is_array($attr) && count($attr)) {
 			foreach ($attr as $k => $v) {
@@ -218,7 +232,7 @@ class Login extends BaseModule
 			$args['photo'] = $photo;
 		}
 
-		$args['openid_url'] = trim(Session::get('openid_identity'));
+		$args['openid_url'] = trim(DI::session()->get('openid_identity'));
 
 		return 'register?' . http_build_query($args);
 	}
diff --git a/src/Module/Security/OpenID.php b/src/Module/Security/OpenID.php
index fec00f8ea1..7dbb765c6d 100644
--- a/src/Module/Security/OpenID.php
+++ b/src/Module/Security/OpenID.php
@@ -73,9 +73,7 @@ class OpenID extends BaseModule
 
 					DI::auth()->setForUser(DI::app(), $user, true, true);
 
-					// just in case there was no return url set
-					// and we fell through
-					DI::baseUrl()->redirect();
+					$this->baseUrl->redirect(DI::session()->pop('return_path', ''));
 				}
 
 				// Successful OpenID login - but we can't match it to an existing account.
@@ -84,7 +82,7 @@ class OpenID extends BaseModule
 				$session->set('openid_identity', $authId);
 
 				// Detect the server URL
-				$open_id_obj = new LightOpenID(DI::baseUrl()->getHostName());
+				$open_id_obj = new LightOpenID(DI::baseUrl()->getHostname());
 				$open_id_obj->identity = $authId;
 				$session->set('openid_server', $open_id_obj->discover($open_id_obj->identity));
 
diff --git a/src/Module/Security/TwoFactor/Recovery.php b/src/Module/Security/TwoFactor/Recovery.php
index ca7215da43..6d8d91dbea 100644
--- a/src/Module/Security/TwoFactor/Recovery.php
+++ b/src/Module/Security/TwoFactor/Recovery.php
@@ -73,6 +73,8 @@ class Recovery extends BaseModule
 				info($this->t('Remaining recovery codes: %d', RecoveryCode::countValidForUser(local_user())));
 
 				$this->auth->setForUser($this->app, User::getById($this->app->getLoggedInUserId()), true, true);
+
+				$this->baseUrl->redirect($this->session->pop('return_path', ''));
 			} else {
 				notice($this->t('Invalid code, please retry.'));
 			}
diff --git a/src/Module/Security/TwoFactor/Trust.php b/src/Module/Security/TwoFactor/Trust.php
index 4ba4ba69b3..1f5fb7418f 100644
--- a/src/Module/Security/TwoFactor/Trust.php
+++ b/src/Module/Security/TwoFactor/Trust.php
@@ -102,6 +102,7 @@ class Trust extends BaseModule
 
 			try {
 				$this->auth->setForUser($this->app, User::getById($this->app->getLoggedInUserId()), true, true);
+				$this->baseUrl->redirect($this->session->pop('return_path', ''));
 			} catch (FoundException | TemporaryRedirectException | MovedPermanentlyException $e) {
 				// exception wanted!
 				throw $e;
@@ -122,7 +123,7 @@ class Trust extends BaseModule
 				$trustedBrowser = $this->trustedBrowserRepository->selectOneByHash($this->cookie->get('2fa_cookie_hash'));
 				if (!$trustedBrowser->trusted) {
 					$this->auth->setForUser($this->app, User::getById($this->app->getLoggedInUserId()), true, true);
-					$this->baseUrl->redirect();
+					$this->baseUrl->redirect($this->session->pop('return_path', ''));
 				}
 			} catch (TrustedBrowserNotFoundException $exception) {
 				$this->logger->notice('Trusted Browser of the cookie not found.', ['cookie_hash' => $this->cookie->get('trusted'), 'uid' => $this->app->getLoggedInUserId(), 'exception' => $exception]);
diff --git a/src/Security/Authentication.php b/src/Security/Authentication.php
index 9f45516f7d..d1e64534c6 100644
--- a/src/Security/Authentication.php
+++ b/src/Security/Authentication.php
@@ -244,15 +244,19 @@ class Authentication
 	/**
 	 * Attempts to authenticate using login/password
 	 *
-	 * @param App    $a        The Friendica Application context
-	 * @param string $username User name
-	 * @param string $password Clear password
-	 * @param bool   $remember Whether to set the session remember flag
+	 * @param App    $a           The Friendica Application context
+	 * @param string $username
+	 * @param string $password    Clear password
+	 * @param bool   $remember    Whether to set the session remember flag
+	 * @param string $return_path The relative path to redirect the user to after authentication
 	 *
-	 * @throws HttpException\InternalServerErrorException In case of Friendica internal exceptions
-	 * @throws Exception A general Exception (like SQL Grammar exceptions)
+	 * @throws HTTPException\ForbiddenException
+	 * @throws HTTPException\FoundException
+	 * @throws HTTPException\InternalServerErrorException In case of Friendica internal exceptions
+	 * @throws HTTPException\MovedPermanentlyException
+	 * @throws HTTPException\TemporaryRedirectException
 	 */
-	public function withPassword(App $a, string $username, string $password, bool $remember)
+	public function withPassword(App $a, string $username, string $password, bool $remember, string $return_path = '')
 	{
 		$record = null;
 
@@ -289,8 +293,6 @@ class Authentication
 
 		$this->setForUser($a, $record, true, true);
 
-		$return_path = $this->session->get('return_path', '');
-		$this->session->remove('return_path');
 
 		$this->baseUrl->redirect($return_path);
 	}
@@ -382,10 +384,6 @@ class Authentication
 
 		if ($login_initial) {
 			Hook::callAll('logged_in', $user_record);
-
-			if (DI::args()->getModuleName() !== 'home' && $this->session->exists('return_path')) {
-				$this->baseUrl->redirect($this->session->get('return_path'));
-			}
 		}
 	}
 

From 49394aedeb96b35303eac061563c754ab23a9b96 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 1 Aug 2022 11:42:10 -0400
Subject: [PATCH 2/3] Add password length limit if using the Blowfish hashing
 algorithm

- Add new page to reset a password that would be too long
- Add support for pattern parameter in field_password
---
 src/Model/User.php                            |  29 ++++-
 src/Module/Security/PasswordTooLong.php       | 103 ++++++++++++++++++
 src/Module/Settings/Account.php               |   5 +-
 src/Security/Authentication.php               |   8 +-
 static/routes.config.php                      |   4 +
 view/templates/field_password.tpl             |   2 +-
 view/templates/security/password_too_long.tpl |  22 ++++
 view/theme/frio/templates/field_password.tpl  |   2 +-
 8 files changed, 169 insertions(+), 6 deletions(-)
 create mode 100644 src/Module/Security/PasswordTooLong.php
 create mode 100644 view/templates/security/password_too_long.tpl

diff --git a/src/Model/User.php b/src/Model/User.php
index 1e002aa3f8..574830603e 100644
--- a/src/Model/User.php
+++ b/src/Model/User.php
@@ -735,6 +735,29 @@ class User
 		return password_hash($password, PASSWORD_DEFAULT);
 	}
 
+	/**
+	 * Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).
+	 *
+	 * Password length is limited to 72 characters if the current default password hashing algorithm is Blowfish.
+	 * From the manual: "Using the PASSWORD_BCRYPT as the algorithm, will result in the password parameter being
+	 * truncated to a maximum length of 72 bytes."
+	 *
+	 * @see https://www.php.net/manual/en/function.password-hash.php#refsect1-function.password-hash-parameters
+	 *
+	 * @param string|null $delimiter Whether the regular expression is meant to be wrapper in delimiter characters
+	 * @return string
+	 */
+	public static function getPasswordRegExp(string $delimiter = null): string
+	{
+		$allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
+
+		if ($delimiter) {
+			$allowed_characters = preg_quote($allowed_characters, $delimiter);
+		}
+
+		return '^[a-zA-Z0-9' . $allowed_characters . ']' . (PASSWORD_DEFAULT !== PASSWORD_BCRYPT ? '{1,72}' : '+') . '$';
+	}
+
 	/**
 	 * Updates a user row with a new plaintext password
 	 *
@@ -755,9 +778,11 @@ class User
 			throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
 		}
 
-		$allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
+		if (PASSWORD_DEFAULT === PASSWORD_BCRYPT && strlen($password) > 72) {
+			throw new Exception(DI::l10n()->t('The password length is limited to 72 characters.'));
+		}
 
-		if (!preg_match('/^[a-z0-9' . preg_quote($allowed_characters, '/') . ']+$/i', $password)) {
+		if (!preg_match('/' . self::getPasswordRegExp('/') . '/', $password)) {
 			throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
 		}
 
diff --git a/src/Module/Security/PasswordTooLong.php b/src/Module/Security/PasswordTooLong.php
new file mode 100644
index 0000000000..9de4a345bb
--- /dev/null
+++ b/src/Module/Security/PasswordTooLong.php
@@ -0,0 +1,103 @@
+<?php
+/**
+ * @copyright Copyright (C) 2010-2022, the Friendica project
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace Friendica\Module\Security;
+
+use Friendica\App;
+use Friendica\Core\L10n;
+use Friendica\Core\Renderer;
+use Friendica\Database\DBA;
+use Friendica\Model\User;
+use Friendica\Module\Response;
+use Friendica\Navigation\SystemMessages;
+use Friendica\Util\Profiler;
+use Psr\Log\LoggerInterface;
+
+class PasswordTooLong extends \Friendica\BaseModule
+{
+	/** @var SystemMessages */
+	private $sysmsg;
+
+	public function __construct(SystemMessages $sysmsg, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, array $server, array $parameters = [])
+	{
+		parent::__construct($l10n, $baseUrl, $args, $logger, $profiler, $response, $server, $parameters);
+
+		$this->sysmsg = $sysmsg;
+	}
+
+	protected function post(array $request = [])
+	{
+		$newpass = $request['password'];
+		$confirm = $request['password_confirm'];
+
+		try {
+			if ($newpass != $confirm) {
+				throw new \Exception($this->l10n->t('Passwords do not match.'));
+			}
+
+			//  check if the old password was supplied correctly before changing it to the new value
+			User::getIdFromPasswordAuthentication(local_user(), $request['password_current']);
+
+			if (strlen($request['password_current']) <= 72) {
+				throw new \Exception($this->l10n->t('Password does not need changing.'));
+			}
+
+			$result = User::updatePassword(local_user(), $newpass);
+			if (!DBA::isResult($result)) {
+				throw new \Exception($this->l10n->t('Password update failed. Please try again.'));
+			}
+
+			$this->sysmsg->addInfo($this->l10n->t('Password changed.'));
+
+			$this->baseUrl->redirect($request['return_url'] ?? '');
+		} catch (\Exception $e) {
+			$this->sysmsg->addNotice($e->getMessage());
+			$this->sysmsg->addNotice($this->l10n->t('Password unchanged.'));
+		}
+	}
+
+	protected function content(array $request = []): string
+	{
+		// Nothing to do here
+		if (PASSWORD_DEFAULT !== PASSWORD_BCRYPT) {
+			$this->baseUrl->redirect();
+		}
+
+		$tpl = Renderer::getMarkupTemplate('security/password_too_long.tpl');
+		$o   = Renderer::replaceMacros($tpl, [
+			'$l10n' => [
+				'ptitle' => $this->l10n->t('Password Too Long'),
+				'desc'   => $this->l10n->t('Since version 2022.09, we\'ve realized that any password longer than 72 characters is truncated during hashing. To prevent any confusion about this behavior, please update your password to be fewer or equal to 72 characters.'),
+				'submit' => $this->l10n->t('Update Password'),
+			],
+
+			'$baseurl'             => $this->baseUrl->get(true),
+			'$form_security_token' => self::getFormSecurityToken('security/password_too_long'),
+			'$return_url'          => $request['return_url'] ?? '',
+
+			'$password_current' => ['password_current', $this->l10n->t('Current Password:'), '', $this->l10n->t('Your current password to confirm the changes'), 'required', 'autocomplete="off"'],
+			'$password'         => ['password', $this->l10n->t('New Password:'), '', $this->l10n->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).') . ' ' . $this->l10n->t('Password length is limited to 72 characters.'), 'required', 'autocomplete="off"', User::getPasswordRegExp()],
+			'$password_confirm' => ['password_confirm', $this->l10n->t('Confirm:'), '', '', 'required', 'autocomplete="off"'],
+		]);
+
+		return $o;
+	}
+}
diff --git a/src/Module/Settings/Account.php b/src/Module/Settings/Account.php
index 33a5feff49..d20827e6ab 100644
--- a/src/Module/Settings/Account.php
+++ b/src/Module/Settings/Account.php
@@ -551,6 +551,9 @@ class Account extends BaseSettings
 
 		$notify_type = DI::pConfig()->get(local_user(), 'system', 'notify_type');
 
+		$passwordRules = DI::l10n()->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).')
+			. (PASSWORD_DEFAULT === PASSWORD_BCRYPT ? ' ' . DI::l10n()->t('Password length is limited to 72 characters.') : '');
+
 		$tpl = Renderer::getMarkupTemplate('settings/account.tpl');
 		$o   = Renderer::replaceMacros($tpl, [
 			'$ptitle' => DI::l10n()->t('Account Settings'),
@@ -563,7 +566,7 @@ class Account extends BaseSettings
 			'$open'                => $this->parameters['open'] ?? 'password',
 
 			'$h_pass'        => DI::l10n()->t('Password Settings'),
-			'$password1'     => ['password', DI::l10n()->t('New Password:'), '', DI::l10n()->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).'), false, 'autocomplete="off"'],
+			'$password1'     => ['password', DI::l10n()->t('New Password:'), '', $passwordRules, false, 'autocomplete="off"', User::getPasswordRegExp()],
 			'$password2'     => ['confirm', DI::l10n()->t('Confirm:'), '', DI::l10n()->t('Leave password fields blank unless changing'), false, 'autocomplete="off"'],
 			'$password3'     => ['opassword', DI::l10n()->t('Current Password:'), '', DI::l10n()->t('Your current password to confirm the changes'), false, 'autocomplete="off"'],
 			'$password4'     => ['mpassword', DI::l10n()->t('Password:'), '', DI::l10n()->t('Your current password to confirm the changes of the email address'), false, 'autocomplete="off"'],
diff --git a/src/Security/Authentication.php b/src/Security/Authentication.php
index d1e64534c6..42dc023404 100644
--- a/src/Security/Authentication.php
+++ b/src/Security/Authentication.php
@@ -291,8 +291,14 @@ class Authentication
 			$this->dba->update('user', ['openid' => $openid_identity, 'openidserver' => $openid_server], ['uid' => $record['uid']]);
 		}
 
-		$this->setForUser($a, $record, true, true);
+		/**
+		 * @see User::getPasswordRegExp()
+		 */
+		if (PASSWORD_DEFAULT === PASSWORD_BCRYPT && strlen($password) > 72) {
+			$return_path = '/security/password_too_long?' . http_build_query(['return_path' => $return_path]);
+		}
 
+		$this->setForUser($a, $record, true, true);
 
 		$this->baseUrl->redirect($return_path);
 	}
diff --git a/static/routes.config.php b/static/routes.config.php
index ce41c23d3a..f9935a53f4 100644
--- a/static/routes.config.php
+++ b/static/routes.config.php
@@ -549,6 +549,10 @@ return [
 		'/{type:users}/{guid}' => [Module\Diaspora\Receive::class, [        R::POST]],
 	],
 
+	'/security' => [
+		'/password_too_long' => [Module\Security\PasswordTooLong::class, [R::GET, R::POST]],
+	],
+
 	'/settings' => [
 		'[/]'         => [Module\Settings\Account::class,               [R::GET, R::POST]],
 		'/account' => [
diff --git a/view/templates/field_password.tpl b/view/templates/field_password.tpl
index 6295880621..07241fb11b 100644
--- a/view/templates/field_password.tpl
+++ b/view/templates/field_password.tpl
@@ -1,7 +1,7 @@
 	
 	<div class="field password" id="wrapper_{{$field.0}}">
 		<label for="id_{{$field.0}}">{{$field.1}}{{if $field.4}} <span class="required" title="{{$field.4}}">*</span>{{/if}}</label>
-		<input type="password" name="{{$field.0}}" id="id_{{$field.0}}" value="{{$field.2 nofilter}}"{{if $field.4}} required{{/if}}{{if $field.5 eq "autofocus"}} autofocus{{/if}} aria-describedby="{{$field.0}}_tip">
+		<input type="password" name="{{$field.0}}" id="id_{{$field.0}}" value="{{$field.2 nofilter}}"{{if $field.4}} required{{/if}}{{if $field.5 eq "autofocus"}} autofocus{{elseif $field.5}} {{$field.5}}{{/if}}{{if $field.6}} pattern="(($field.6}}"{{/if}} aria-describedby="{{$field.0}}_tip">
 		{{if $field.3}}
 		<span class="field_help" role="tooltip" id="{{$field.0}}_tip">{{$field.3 nofilter}}</span>
 		{{/if}}
diff --git a/view/templates/security/password_too_long.tpl b/view/templates/security/password_too_long.tpl
new file mode 100644
index 0000000000..81e698597d
--- /dev/null
+++ b/view/templates/security/password_too_long.tpl
@@ -0,0 +1,22 @@
+<div class="generic-page-wrapper">
+	<h1>{{$l10n.ptitle}}</h1>
+
+	<div id="settings-nick-wrapper">
+		<div id="settings-nickname-desc" class="info-message">{{$l10n.desc}}</div>
+	</div>
+	<div id="settings-nick-end"></div>
+
+	<div id="settings-form">
+		<form class="settings-content-block" action="security/password_too_long" method="post" autocomplete="off" enctype="multipart/form-data">
+			<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+			<input type="hidden" name="return_url" value="{{$return_url}}">
+			{{include file="field_password.tpl" field=$password_current}}
+			{{include file="field_password.tpl" field=$password}}
+			{{include file="field_password.tpl" field=$password_confirm}}
+
+			<div class="settings-submit-wrapper">
+				<button type="submit" name="password-submit" class="btn btn-primary" value="{{$l10n.submit}}">{{$l10n.submit}}</button>
+			</div>
+		</form>
+	</div>
+</div>
diff --git a/view/theme/frio/templates/field_password.tpl b/view/theme/frio/templates/field_password.tpl
index df29b2fda2..25a7d0c4ce 100644
--- a/view/theme/frio/templates/field_password.tpl
+++ b/view/theme/frio/templates/field_password.tpl
@@ -1,7 +1,7 @@
 
 <div id="id_{{$field.0}}_wrapper" class="form-group field input password">
 	<label for="id_{{$field.0}}" id="label_{{$field.0}}">{{$field.1}}{{if $field.4}} <span class="required" title="{{$field.4}}">*</span>{{/if}}</label>
-	<input class="form-control" name="{{$field.0}}" id="id_{{$field.0}}" type="password" value="{{$field.2 nofilter}}" {{if $field.4}} required{{/if}}{{if $field.5 eq "autofocus"}} autofocus{{elseif $field.5}} {{$field.5}}{{/if}} aria-describedby="{{$field.0}}_tip">
+	<input class="form-control" name="{{$field.0}}" id="id_{{$field.0}}" type="password" value="{{$field.2 nofilter}}" {{if $field.4}} required{{/if}}{{if $field.5 eq "autofocus"}} autofocus{{elseif $field.5}} {{$field.5}}{{/if}}{{if $field.6}} pattern="{{$field.6}}"{{/if}} aria-describedby="{{$field.0}}_tip">
 	{{if $field.3}}
 	<span class="help-block" id="{{$field.0}}_tip" role="tooltip">{{$field.3 nofilter}}</span>
 	{{/if}}

From 6857dbe71f42b51edbe5aa6d823054e40331e95c Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 1 Aug 2022 12:25:36 -0400
Subject: [PATCH 3/3] Updated main translation file after adding strings

---
 view/lang/C/messages.po | 461 ++++++++++++++++++++++------------------
 1 file changed, 249 insertions(+), 212 deletions(-)

diff --git a/view/lang/C/messages.po b/view/lang/C/messages.po
index 16f7081221..cf29605f7e 100644
--- a/view/lang/C/messages.po
+++ b/view/lang/C/messages.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: 2022.09-dev\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-29 21:32+0000\n"
+"POT-Creation-Date: 2022-08-01 12:24-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -85,7 +85,7 @@ msgstr ""
 msgid "list"
 msgstr ""
 
-#: mod/cal.php:265 src/Console/User.php:182 src/Model/User.php:662
+#: mod/cal.php:265 src/Console/User.php:182 src/Model/User.php:663
 #: src/Module/Admin/Users/Active.php:73 src/Module/Admin/Users/Blocked.php:74
 #: src/Module/Admin/Users/Index.php:80 src/Module/Admin/Users/Pending.php:71
 #: src/Module/Api/Twitter/ContactEndpoint.php:74
@@ -470,7 +470,7 @@ msgid "OStatus support is disabled. Contact can't be added."
 msgstr ""
 
 #: mod/follow.php:138 src/Content/Item.php:459 src/Content/Widget.php:80
-#: src/Model/Contact.php:1104 src/Model/Contact.php:1116
+#: src/Model/Contact.php:1114 src/Model/Contact.php:1126
 #: view/theme/vier/theme.php:181
 msgid "Connect/Follow"
 msgstr ""
@@ -610,7 +610,7 @@ msgid ""
 "your email for further instructions."
 msgstr ""
 
-#: mod/lostpass.php:130 src/Module/Security/Login.php:147
+#: mod/lostpass.php:130 src/Module/Security/Login.php:161
 msgid "Nickname or Email: "
 msgstr ""
 
@@ -618,7 +618,7 @@ msgstr ""
 msgid "Reset"
 msgstr ""
 
-#: mod/lostpass.php:146 src/Module/Security/Login.php:159
+#: mod/lostpass.php:146 src/Module/Security/Login.php:173
 msgid "Password Reset"
 msgstr ""
 
@@ -1207,7 +1207,7 @@ msgstr ""
 #: mod/settings.php:352 src/Module/Admin/Addons/Index.php:69
 #: src/Module/Admin/Features.php:87 src/Module/Admin/Logs/Settings.php:81
 #: src/Module/Admin/Site.php:436 src/Module/Admin/Themes/Index.php:113
-#: src/Module/Admin/Tos.php:83 src/Module/Settings/Account.php:559
+#: src/Module/Admin/Tos.php:83 src/Module/Settings/Account.php:562
 #: src/Module/Settings/Delegation.php:170 src/Module/Settings/Display.php:193
 msgid "Save Settings"
 msgstr ""
@@ -1762,11 +1762,13 @@ msgstr ""
 msgid "Enter new password: "
 msgstr ""
 
-#: src/Console/User.php:210 src/Module/Settings/Account.php:74
+#: src/Console/User.php:210 src/Module/Security/PasswordTooLong.php:65
+#: src/Module/Settings/Account.php:74
 msgid "Password update failed. Please try again."
 msgstr ""
 
-#: src/Console/User.php:213 src/Module/Settings/Account.php:77
+#: src/Console/User.php:213 src/Module/Security/PasswordTooLong.php:68
+#: src/Module/Settings/Account.php:77
 msgid "Password changed."
 msgstr ""
 
@@ -2303,31 +2305,31 @@ msgstr ""
 msgid "Follow Thread"
 msgstr ""
 
-#: src/Content/Item.php:439 src/Model/Contact.php:1109
+#: src/Content/Item.php:439 src/Model/Contact.php:1119
 msgid "View Status"
 msgstr ""
 
-#: src/Content/Item.php:440 src/Content/Item.php:462 src/Model/Contact.php:1043
-#: src/Model/Contact.php:1101 src/Model/Contact.php:1110
+#: src/Content/Item.php:440 src/Content/Item.php:462 src/Model/Contact.php:1053
+#: src/Model/Contact.php:1111 src/Model/Contact.php:1120
 #: src/Module/Directory.php:158 src/Module/Settings/Profile/Index.php:225
 msgid "View Profile"
 msgstr ""
 
-#: src/Content/Item.php:441 src/Model/Contact.php:1111
+#: src/Content/Item.php:441 src/Model/Contact.php:1121
 msgid "View Photos"
 msgstr ""
 
-#: src/Content/Item.php:442 src/Model/Contact.php:1102
-#: src/Model/Contact.php:1112
+#: src/Content/Item.php:442 src/Model/Contact.php:1112
+#: src/Model/Contact.php:1122
 msgid "Network Posts"
 msgstr ""
 
-#: src/Content/Item.php:443 src/Model/Contact.php:1103
-#: src/Model/Contact.php:1113
+#: src/Content/Item.php:443 src/Model/Contact.php:1113
+#: src/Model/Contact.php:1123
 msgid "View Contact"
 msgstr ""
 
-#: src/Content/Item.php:444 src/Model/Contact.php:1114
+#: src/Content/Item.php:444 src/Model/Contact.php:1124
 msgid "Send PM"
 msgstr ""
 
@@ -2350,7 +2352,7 @@ msgstr ""
 msgid "Languages"
 msgstr ""
 
-#: src/Content/Item.php:454 src/Model/Contact.php:1115
+#: src/Content/Item.php:454 src/Model/Contact.php:1125
 msgid "Poke"
 msgstr ""
 
@@ -2370,7 +2372,7 @@ msgstr ""
 msgid "@name, !forum, #tags, content"
 msgstr ""
 
-#: src/Content/Nav.php:185 src/Module/Security/Login.php:144
+#: src/Content/Nav.php:185 src/Module/Security/Login.php:158
 msgid "Logout"
 msgstr ""
 
@@ -2379,7 +2381,7 @@ msgid "End this session"
 msgstr ""
 
 #: src/Content/Nav.php:187 src/Module/Bookmarklet.php:44
-#: src/Module/Security/Login.php:145
+#: src/Module/Security/Login.php:159
 msgid "Login"
 msgstr ""
 
@@ -2440,7 +2442,7 @@ msgid "Home"
 msgstr ""
 
 #: src/Content/Nav.php:218 src/Module/Register.php:168
-#: src/Module/Security/Login.php:105
+#: src/Module/Security/Login.php:124
 msgid "Register"
 msgstr ""
 
@@ -2802,7 +2804,7 @@ msgstr ""
 msgid "Organisations"
 msgstr ""
 
-#: src/Content/Widget.php:523 src/Model/Contact.php:1537
+#: src/Content/Widget.php:523 src/Model/Contact.php:1547
 msgid "News"
 msgstr ""
 
@@ -3638,81 +3640,81 @@ msgstr ""
 msgid "Legacy module file not found: %s"
 msgstr ""
 
-#: src/Model/Contact.php:1105 src/Model/Contact.php:1117
+#: src/Model/Contact.php:1115 src/Model/Contact.php:1127
 msgid "UnFollow"
 msgstr ""
 
-#: src/Model/Contact.php:1123 src/Module/Admin/Users/Pending.php:107
+#: src/Model/Contact.php:1133 src/Module/Admin/Users/Pending.php:107
 #: src/Module/Notifications/Introductions.php:130
 #: src/Module/Notifications/Introductions.php:202
 msgid "Approve"
 msgstr ""
 
-#: src/Model/Contact.php:1533
+#: src/Model/Contact.php:1543
 msgid "Organisation"
 msgstr ""
 
-#: src/Model/Contact.php:1541
+#: src/Model/Contact.php:1551
 msgid "Forum"
 msgstr ""
 
-#: src/Model/Contact.php:2630
+#: src/Model/Contact.php:2640
 msgid "Disallowed profile URL."
 msgstr ""
 
-#: src/Model/Contact.php:2635 src/Module/Friendica.php:81
+#: src/Model/Contact.php:2645 src/Module/Friendica.php:81
 msgid "Blocked domain"
 msgstr ""
 
-#: src/Model/Contact.php:2640
+#: src/Model/Contact.php:2650
 msgid "Connect URL missing."
 msgstr ""
 
-#: src/Model/Contact.php:2649
+#: src/Model/Contact.php:2659
 msgid ""
 "The contact could not be added. Please check the relevant network "
 "credentials in your Settings -> Social Networks page."
 msgstr ""
 
-#: src/Model/Contact.php:2691
+#: src/Model/Contact.php:2701
 msgid "The profile address specified does not provide adequate information."
 msgstr ""
 
-#: src/Model/Contact.php:2693
+#: src/Model/Contact.php:2703
 msgid "No compatible communication protocols or feeds were discovered."
 msgstr ""
 
-#: src/Model/Contact.php:2696
+#: src/Model/Contact.php:2706
 msgid "An author or name was not found."
 msgstr ""
 
-#: src/Model/Contact.php:2699
+#: src/Model/Contact.php:2709
 msgid "No browser URL could be matched to this address."
 msgstr ""
 
-#: src/Model/Contact.php:2702
+#: src/Model/Contact.php:2712
 msgid ""
 "Unable to match @-style Identity Address with a known protocol or email "
 "contact."
 msgstr ""
 
-#: src/Model/Contact.php:2703
+#: src/Model/Contact.php:2713
 msgid "Use mailto: in front of address to force email check."
 msgstr ""
 
-#: src/Model/Contact.php:2709
+#: src/Model/Contact.php:2719
 msgid ""
 "The profile address specified belongs to a network which has been disabled "
 "on this site."
 msgstr ""
 
-#: src/Model/Contact.php:2714
+#: src/Model/Contact.php:2724
 msgid ""
 "Limited profile. This person will be unable to receive direct/personal "
 "notifications from you."
 msgstr ""
 
-#: src/Model/Contact.php:2773
+#: src/Model/Contact.php:2783
 msgid "Unable to retrieve contact information."
 msgstr ""
 
@@ -4031,142 +4033,146 @@ msgstr ""
 msgid "Contact information and Social Networks"
 msgstr ""
 
-#: src/Model/User.php:212 src/Model/User.php:1059
+#: src/Model/User.php:212 src/Model/User.php:1085
 msgid "SERIOUS ERROR: Generation of security keys failed."
 msgstr ""
 
-#: src/Model/User.php:571 src/Model/User.php:604
+#: src/Model/User.php:572 src/Model/User.php:605
 msgid "Login failed"
 msgstr ""
 
-#: src/Model/User.php:636
+#: src/Model/User.php:637
 msgid "Not enough information to authenticate"
 msgstr ""
 
-#: src/Model/User.php:731
+#: src/Model/User.php:732
 msgid "Password can't be empty"
 msgstr ""
 
-#: src/Model/User.php:750
+#: src/Model/User.php:774
 msgid "Empty passwords are not allowed."
 msgstr ""
 
-#: src/Model/User.php:754
+#: src/Model/User.php:778
 msgid ""
 "The new password has been exposed in a public data dump, please choose "
 "another."
 msgstr ""
 
-#: src/Model/User.php:760
+#: src/Model/User.php:782
+msgid "The password length is limited to 72 characters."
+msgstr ""
+
+#: src/Model/User.php:786
 msgid ""
 "The password can't contain accentuated letters, white spaces or colons (:)"
 msgstr ""
 
-#: src/Model/User.php:939
+#: src/Model/User.php:965
 msgid "Passwords do not match. Password unchanged."
 msgstr ""
 
-#: src/Model/User.php:946
+#: src/Model/User.php:972
 msgid "An invitation is required."
 msgstr ""
 
-#: src/Model/User.php:950
+#: src/Model/User.php:976
 msgid "Invitation could not be verified."
 msgstr ""
 
-#: src/Model/User.php:958
+#: src/Model/User.php:984
 msgid "Invalid OpenID url"
 msgstr ""
 
-#: src/Model/User.php:971 src/Security/Authentication.php:240
+#: src/Model/User.php:997 src/Security/Authentication.php:240
 msgid ""
 "We encountered a problem while logging in with the OpenID you provided. "
 "Please check the correct spelling of the ID."
 msgstr ""
 
-#: src/Model/User.php:971 src/Security/Authentication.php:240
+#: src/Model/User.php:997 src/Security/Authentication.php:240
 msgid "The error message was:"
 msgstr ""
 
-#: src/Model/User.php:977
+#: src/Model/User.php:1003
 msgid "Please enter the required information."
 msgstr ""
 
-#: src/Model/User.php:991
+#: src/Model/User.php:1017
 #, php-format
 msgid ""
 "system.username_min_length (%s) and system.username_max_length (%s) are "
 "excluding each other, swapping values."
 msgstr ""
 
-#: src/Model/User.php:998
+#: src/Model/User.php:1024
 #, php-format
 msgid "Username should be at least %s character."
 msgid_plural "Username should be at least %s characters."
 msgstr[0] ""
 msgstr[1] ""
 
-#: src/Model/User.php:1002
+#: src/Model/User.php:1028
 #, php-format
 msgid "Username should be at most %s character."
 msgid_plural "Username should be at most %s characters."
 msgstr[0] ""
 msgstr[1] ""
 
-#: src/Model/User.php:1010
+#: src/Model/User.php:1036
 msgid "That doesn't appear to be your full (First Last) name."
 msgstr ""
 
-#: src/Model/User.php:1015
+#: src/Model/User.php:1041
 msgid "Your email domain is not among those allowed on this site."
 msgstr ""
 
-#: src/Model/User.php:1019
+#: src/Model/User.php:1045
 msgid "Not a valid email address."
 msgstr ""
 
-#: src/Model/User.php:1022
+#: src/Model/User.php:1048
 msgid "The nickname was blocked from registration by the nodes admin."
 msgstr ""
 
-#: src/Model/User.php:1026 src/Model/User.php:1034
+#: src/Model/User.php:1052 src/Model/User.php:1060
 msgid "Cannot use that email."
 msgstr ""
 
-#: src/Model/User.php:1041
+#: src/Model/User.php:1067
 msgid "Your nickname can only contain a-z, 0-9 and _."
 msgstr ""
 
-#: src/Model/User.php:1049 src/Model/User.php:1106
+#: src/Model/User.php:1075 src/Model/User.php:1132
 msgid "Nickname is already registered. Please choose another."
 msgstr ""
 
-#: src/Model/User.php:1093 src/Model/User.php:1097
+#: src/Model/User.php:1119 src/Model/User.php:1123
 msgid "An error occurred during registration. Please try again."
 msgstr ""
 
-#: src/Model/User.php:1120
+#: src/Model/User.php:1146
 msgid "An error occurred creating your default profile. Please try again."
 msgstr ""
 
-#: src/Model/User.php:1127
+#: src/Model/User.php:1153
 msgid "An error occurred creating your self contact. Please try again."
 msgstr ""
 
-#: src/Model/User.php:1132
+#: src/Model/User.php:1158
 msgid "Friends"
 msgstr ""
 
-#: src/Model/User.php:1136
+#: src/Model/User.php:1162
 msgid ""
 "An error occurred creating your default contact group. Please try again."
 msgstr ""
 
-#: src/Model/User.php:1175
+#: src/Model/User.php:1201
 msgid "Profile Photos"
 msgstr ""
 
-#: src/Model/User.php:1368
+#: src/Model/User.php:1394
 #, php-format
 msgid ""
 "\n"
@@ -4174,7 +4180,7 @@ msgid ""
 "\t\t\tthe administrator of %2$s has set up an account for you."
 msgstr ""
 
-#: src/Model/User.php:1371
+#: src/Model/User.php:1397
 #, php-format
 msgid ""
 "\n"
@@ -4211,12 +4217,12 @@ msgid ""
 "\t\tThank you and welcome to %4$s."
 msgstr ""
 
-#: src/Model/User.php:1404 src/Model/User.php:1511
+#: src/Model/User.php:1430 src/Model/User.php:1537
 #, php-format
 msgid "Registration details for %s"
 msgstr ""
 
-#: src/Model/User.php:1424
+#: src/Model/User.php:1450
 #, php-format
 msgid ""
 "\n"
@@ -4232,12 +4238,12 @@ msgid ""
 "\t\t"
 msgstr ""
 
-#: src/Model/User.php:1443
+#: src/Model/User.php:1469
 #, php-format
 msgid "Registration at %s"
 msgstr ""
 
-#: src/Model/User.php:1467
+#: src/Model/User.php:1493
 #, php-format
 msgid ""
 "\n"
@@ -4246,7 +4252,7 @@ msgid ""
 "\t\t\t"
 msgstr ""
 
-#: src/Model/User.php:1475
+#: src/Model/User.php:1501
 #, php-format
 msgid ""
 "\n"
@@ -8397,7 +8403,7 @@ msgid ""
 "\"btn btn-sm pull-right\">Cancel</a>"
 msgstr ""
 
-#: src/Module/Profile/Profile.php:144 src/Module/Settings/Account.php:575
+#: src/Module/Profile/Profile.php:144 src/Module/Settings/Account.php:578
 msgid "Full Name:"
 msgstr ""
 
@@ -8444,19 +8450,19 @@ msgstr ""
 
 #: src/Module/Profile/Profile.php:326 src/Module/Profile/Profile.php:329
 #: src/Module/Profile/Status.php:66 src/Module/Profile/Status.php:69
-#: src/Protocol/Feed.php:1018 src/Protocol/OStatus.php:1046
+#: src/Protocol/Feed.php:1025 src/Protocol/OStatus.php:1046
 #, php-format
 msgid "%s's timeline"
 msgstr ""
 
 #: src/Module/Profile/Profile.php:327 src/Module/Profile/Status.php:67
-#: src/Protocol/Feed.php:1022 src/Protocol/OStatus.php:1051
+#: src/Protocol/Feed.php:1029 src/Protocol/OStatus.php:1051
 #, php-format
 msgid "%s's posts"
 msgstr ""
 
 #: src/Module/Profile/Profile.php:328 src/Module/Profile/Status.php:68
-#: src/Protocol/Feed.php:1025 src/Protocol/OStatus.php:1055
+#: src/Protocol/Feed.php:1032 src/Protocol/OStatus.php:1055
 #, php-format
 msgid "%s's comments"
 msgstr ""
@@ -8527,7 +8533,8 @@ msgstr ""
 msgid "Please repeat your e-mail address:"
 msgstr ""
 
-#: src/Module/Register.php:162 src/Module/Settings/Account.php:566
+#: src/Module/Register.php:162 src/Module/Security/PasswordTooLong.php:97
+#: src/Module/Settings/Account.php:569
 msgid "New Password:"
 msgstr ""
 
@@ -8535,7 +8542,8 @@ msgstr ""
 msgid "Leave empty for an auto generated password."
 msgstr ""
 
-#: src/Module/Register.php:163 src/Module/Settings/Account.php:567
+#: src/Module/Register.php:163 src/Module/Security/PasswordTooLong.php:98
+#: src/Module/Settings/Account.php:570
 msgid "Confirm:"
 msgstr ""
 
@@ -8681,49 +8689,49 @@ msgstr ""
 msgid "Search term was not removed."
 msgstr ""
 
-#: src/Module/Security/Login.php:104
+#: src/Module/Security/Login.php:123
 msgid "Create a New Account"
 msgstr ""
 
-#: src/Module/Security/Login.php:129
+#: src/Module/Security/Login.php:143
 msgid "Your OpenID: "
 msgstr ""
 
-#: src/Module/Security/Login.php:132
+#: src/Module/Security/Login.php:146
 msgid ""
 "Please enter your username and password to add the OpenID to your existing "
 "account."
 msgstr ""
 
-#: src/Module/Security/Login.php:134
+#: src/Module/Security/Login.php:148
 msgid "Or login using OpenID: "
 msgstr ""
 
-#: src/Module/Security/Login.php:148
+#: src/Module/Security/Login.php:162
 msgid "Password: "
 msgstr ""
 
-#: src/Module/Security/Login.php:149
+#: src/Module/Security/Login.php:163
 msgid "Remember me"
 msgstr ""
 
-#: src/Module/Security/Login.php:158
+#: src/Module/Security/Login.php:172
 msgid "Forgot your password?"
 msgstr ""
 
-#: src/Module/Security/Login.php:161
+#: src/Module/Security/Login.php:175
 msgid "Website Terms of Service"
 msgstr ""
 
-#: src/Module/Security/Login.php:162
+#: src/Module/Security/Login.php:176
 msgid "terms of service"
 msgstr ""
 
-#: src/Module/Security/Login.php:164
+#: src/Module/Security/Login.php:178
 msgid "Website Privacy Policy"
 msgstr ""
 
-#: src/Module/Security/Login.php:165
+#: src/Module/Security/Login.php:179
 msgid "privacy policy"
 msgstr ""
 
@@ -8739,50 +8747,101 @@ msgstr ""
 msgid "OpenID protocol error. No ID returned"
 msgstr ""
 
-#: src/Module/Security/OpenID.php:92
+#: src/Module/Security/OpenID.php:90
 msgid ""
 "Account not found. Please login to your existing account to add the OpenID "
 "to it."
 msgstr ""
 
-#: src/Module/Security/OpenID.php:94
+#: src/Module/Security/OpenID.php:92
 msgid ""
 "Account not found. Please register a new account or login to your existing "
 "account to add the OpenID to it."
 msgstr ""
 
+#: src/Module/Security/PasswordTooLong.php:53
+#: src/Module/Settings/Account.php:66
+msgid "Passwords do not match."
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:60
+msgid "Password does not need changing."
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:73
+#: src/Module/Settings/Account.php:80
+msgid "Password unchanged."
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:87
+msgid "Password Too Long"
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:88
+msgid ""
+"Since version 2022.09, we've realized that any password longer than 72 "
+"characters is truncated during hashing. To prevent any confusion about this "
+"behavior, please update your password to be fewer or equal to 72 characters."
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:89
+msgid "Update Password"
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:96
+#: src/Module/Settings/Account.php:571
+msgid "Current Password:"
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:96
+#: src/Module/Settings/Account.php:571
+msgid "Your current password to confirm the changes"
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:97
+#: src/Module/Settings/Account.php:554
+msgid ""
+"Allowed characters are a-z, A-Z, 0-9 and special characters except white "
+"spaces, accentuated letters and colon (:)."
+msgstr ""
+
+#: src/Module/Security/PasswordTooLong.php:97
+#: src/Module/Settings/Account.php:555
+msgid "Password length is limited to 72 characters."
+msgstr ""
+
 #: src/Module/Security/TwoFactor/Recovery.php:73
 #, php-format
 msgid "Remaining recovery codes: %d"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Recovery.php:77
+#: src/Module/Security/TwoFactor/Recovery.php:79
 #: src/Module/Security/TwoFactor/Verify.php:77
 #: src/Module/Settings/TwoFactor/Verify.php:94
 msgid "Invalid code, please retry."
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Recovery.php:96
+#: src/Module/Security/TwoFactor/Recovery.php:98
 msgid "Two-factor recovery"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Recovery.php:97
+#: src/Module/Security/TwoFactor/Recovery.php:99
 msgid ""
 "<p>You can enter one of your one-time recovery codes in case you lost access "
 "to your mobile device.</p>"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Recovery.php:98
+#: src/Module/Security/TwoFactor/Recovery.php:100
 #, php-format
 msgid ""
 "Don’t have your phone? <a href=\"%s\">Enter a two-factor recovery code</a>"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Recovery.php:99
+#: src/Module/Security/TwoFactor/Recovery.php:101
 msgid "Please enter a recovery code"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Recovery.php:100
+#: src/Module/Security/TwoFactor/Recovery.php:102
 msgid "Submit recovery code and complete login"
 msgstr ""
 
@@ -8808,25 +8867,25 @@ msgstr ""
 msgid "Couldn't save browser to Cookie."
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Trust.php:139
+#: src/Module/Security/TwoFactor/Trust.php:140
 msgid "Trust this browser?"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Trust.php:140
+#: src/Module/Security/TwoFactor/Trust.php:141
 msgid ""
 "<p>If you choose to trust this browser, you will not be asked for a "
 "verification code the next time you sign in.</p>"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Trust.php:141
+#: src/Module/Security/TwoFactor/Trust.php:142
 msgid "Not now"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Trust.php:142
+#: src/Module/Security/TwoFactor/Trust.php:143
 msgid "Don't trust"
 msgstr ""
 
-#: src/Module/Security/TwoFactor/Trust.php:143
+#: src/Module/Security/TwoFactor/Trust.php:144
 msgid "Trust"
 msgstr ""
 
@@ -8852,14 +8911,6 @@ msgstr ""
 msgid "Verify code and complete login"
 msgstr ""
 
-#: src/Module/Settings/Account.php:66
-msgid "Passwords do not match."
-msgstr ""
-
-#: src/Module/Settings/Account.php:80
-msgid "Password unchanged."
-msgstr ""
-
 #: src/Module/Settings/Account.php:95
 msgid "Please use a shorter name."
 msgstr ""
@@ -8987,96 +9038,82 @@ msgid ""
 "g. <a href=\"%s\">%s</a>)."
 msgstr ""
 
-#: src/Module/Settings/Account.php:556
+#: src/Module/Settings/Account.php:559
 msgid "Account Settings"
 msgstr ""
 
-#: src/Module/Settings/Account.php:557
+#: src/Module/Settings/Account.php:560
 #, php-format
 msgid "Your Identity Address is <strong>'%s'</strong> or '%s'."
 msgstr ""
 
-#: src/Module/Settings/Account.php:565
+#: src/Module/Settings/Account.php:568
 msgid "Password Settings"
 msgstr ""
 
-#: src/Module/Settings/Account.php:566
-msgid ""
-"Allowed characters are a-z, A-Z, 0-9 and special characters except white "
-"spaces, accentuated letters and colon (:)."
-msgstr ""
-
-#: src/Module/Settings/Account.php:567
+#: src/Module/Settings/Account.php:570
 msgid "Leave password fields blank unless changing"
 msgstr ""
 
-#: src/Module/Settings/Account.php:568
-msgid "Current Password:"
-msgstr ""
-
-#: src/Module/Settings/Account.php:568
-msgid "Your current password to confirm the changes"
-msgstr ""
-
-#: src/Module/Settings/Account.php:569
+#: src/Module/Settings/Account.php:572
 msgid "Password:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:569
+#: src/Module/Settings/Account.php:572
 msgid "Your current password to confirm the changes of the email address"
 msgstr ""
 
-#: src/Module/Settings/Account.php:572
+#: src/Module/Settings/Account.php:575
 msgid "Delete OpenID URL"
 msgstr ""
 
-#: src/Module/Settings/Account.php:574
+#: src/Module/Settings/Account.php:577
 msgid "Basic Settings"
 msgstr ""
 
-#: src/Module/Settings/Account.php:576
+#: src/Module/Settings/Account.php:579
 msgid "Email Address:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:577
+#: src/Module/Settings/Account.php:580
 msgid "Your Timezone:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:578
+#: src/Module/Settings/Account.php:581
 msgid "Your Language:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:578
+#: src/Module/Settings/Account.php:581
 msgid ""
 "Set the language we use to show you friendica interface and to send you "
 "emails"
 msgstr ""
 
-#: src/Module/Settings/Account.php:579
+#: src/Module/Settings/Account.php:582
 msgid "Default Post Location:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:580
+#: src/Module/Settings/Account.php:583
 msgid "Use Browser Location:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:582
+#: src/Module/Settings/Account.php:585
 msgid "Security and Privacy Settings"
 msgstr ""
 
-#: src/Module/Settings/Account.php:584
+#: src/Module/Settings/Account.php:587
 msgid "Maximum Friend Requests/Day:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:584 src/Module/Settings/Account.php:594
+#: src/Module/Settings/Account.php:587 src/Module/Settings/Account.php:597
 msgid "(to prevent spam abuse)"
 msgstr ""
 
-#: src/Module/Settings/Account.php:586
+#: src/Module/Settings/Account.php:589
 msgid "Allow your profile to be searchable globally?"
 msgstr ""
 
-#: src/Module/Settings/Account.php:586
+#: src/Module/Settings/Account.php:589
 msgid ""
 "Activate this setting if you want others to easily find and follow you. Your "
 "profile will be searchable on remote systems. This setting also determines "
@@ -9084,43 +9121,43 @@ msgid ""
 "indexed or not."
 msgstr ""
 
-#: src/Module/Settings/Account.php:587
+#: src/Module/Settings/Account.php:590
 msgid "Hide your contact/friend list from viewers of your profile?"
 msgstr ""
 
-#: src/Module/Settings/Account.php:587
+#: src/Module/Settings/Account.php:590
 msgid ""
 "A list of your contacts is displayed on your profile page. Activate this "
 "option to disable the display of your contact list."
 msgstr ""
 
-#: src/Module/Settings/Account.php:588
+#: src/Module/Settings/Account.php:591
 msgid "Hide your profile details from anonymous viewers?"
 msgstr ""
 
-#: src/Module/Settings/Account.php:588
+#: src/Module/Settings/Account.php:591
 msgid ""
 "Anonymous visitors will only see your profile picture, your display name and "
 "the nickname you are using on your profile page. Your public posts and "
 "replies will still be accessible by other means."
 msgstr ""
 
-#: src/Module/Settings/Account.php:589
+#: src/Module/Settings/Account.php:592
 msgid "Make public posts unlisted"
 msgstr ""
 
-#: src/Module/Settings/Account.php:589
+#: src/Module/Settings/Account.php:592
 msgid ""
 "Your public posts will not appear on the community pages or in search "
 "results, nor be sent to relay servers. However they can still appear on "
 "public feeds on remote servers."
 msgstr ""
 
-#: src/Module/Settings/Account.php:590
+#: src/Module/Settings/Account.php:593
 msgid "Make all posted pictures accessible"
 msgstr ""
 
-#: src/Module/Settings/Account.php:590
+#: src/Module/Settings/Account.php:593
 msgid ""
 "This option makes every posted picture accessible via the direct link. This "
 "is a workaround for the problem that most other networks can't handle "
@@ -9128,237 +9165,237 @@ msgid ""
 "public on your photo albums though."
 msgstr ""
 
-#: src/Module/Settings/Account.php:591
+#: src/Module/Settings/Account.php:594
 msgid "Allow friends to post to your profile page?"
 msgstr ""
 
-#: src/Module/Settings/Account.php:591
+#: src/Module/Settings/Account.php:594
 msgid ""
 "Your contacts may write posts on your profile wall. These posts will be "
 "distributed to your contacts"
 msgstr ""
 
-#: src/Module/Settings/Account.php:592
+#: src/Module/Settings/Account.php:595
 msgid "Allow friends to tag your posts?"
 msgstr ""
 
-#: src/Module/Settings/Account.php:592
+#: src/Module/Settings/Account.php:595
 msgid "Your contacts can add additional tags to your posts."
 msgstr ""
 
-#: src/Module/Settings/Account.php:593
+#: src/Module/Settings/Account.php:596
 msgid "Permit unknown people to send you private mail?"
 msgstr ""
 
-#: src/Module/Settings/Account.php:593
+#: src/Module/Settings/Account.php:596
 msgid ""
 "Friendica network users may send you private messages even if they are not "
 "in your contact list."
 msgstr ""
 
-#: src/Module/Settings/Account.php:594
+#: src/Module/Settings/Account.php:597
 msgid "Maximum private messages per day from unknown people:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:596
+#: src/Module/Settings/Account.php:599
 msgid "Default Post Permissions"
 msgstr ""
 
-#: src/Module/Settings/Account.php:600
+#: src/Module/Settings/Account.php:603
 msgid "Expiration settings"
 msgstr ""
 
-#: src/Module/Settings/Account.php:601
+#: src/Module/Settings/Account.php:604
 msgid "Automatically expire posts after this many days:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:601
+#: src/Module/Settings/Account.php:604
 msgid "If empty, posts will not expire. Expired posts will be deleted"
 msgstr ""
 
-#: src/Module/Settings/Account.php:602
+#: src/Module/Settings/Account.php:605
 msgid "Expire posts"
 msgstr ""
 
-#: src/Module/Settings/Account.php:602
+#: src/Module/Settings/Account.php:605
 msgid "When activated, posts and comments will be expired."
 msgstr ""
 
-#: src/Module/Settings/Account.php:603
+#: src/Module/Settings/Account.php:606
 msgid "Expire personal notes"
 msgstr ""
 
-#: src/Module/Settings/Account.php:603
+#: src/Module/Settings/Account.php:606
 msgid ""
 "When activated, the personal notes on your profile page will be expired."
 msgstr ""
 
-#: src/Module/Settings/Account.php:604
+#: src/Module/Settings/Account.php:607
 msgid "Expire starred posts"
 msgstr ""
 
-#: src/Module/Settings/Account.php:604
+#: src/Module/Settings/Account.php:607
 msgid ""
 "Starring posts keeps them from being expired. That behaviour is overwritten "
 "by this setting."
 msgstr ""
 
-#: src/Module/Settings/Account.php:605
+#: src/Module/Settings/Account.php:608
 msgid "Only expire posts by others"
 msgstr ""
 
-#: src/Module/Settings/Account.php:605
+#: src/Module/Settings/Account.php:608
 msgid ""
 "When activated, your own posts never expire. Then the settings above are "
 "only valid for posts you received."
 msgstr ""
 
-#: src/Module/Settings/Account.php:608
+#: src/Module/Settings/Account.php:611
 msgid "Notification Settings"
 msgstr ""
 
-#: src/Module/Settings/Account.php:609
+#: src/Module/Settings/Account.php:612
 msgid "Send a notification email when:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:610
+#: src/Module/Settings/Account.php:613
 msgid "You receive an introduction"
 msgstr ""
 
-#: src/Module/Settings/Account.php:611
+#: src/Module/Settings/Account.php:614
 msgid "Your introductions are confirmed"
 msgstr ""
 
-#: src/Module/Settings/Account.php:612
+#: src/Module/Settings/Account.php:615
 msgid "Someone writes on your profile wall"
 msgstr ""
 
-#: src/Module/Settings/Account.php:613
+#: src/Module/Settings/Account.php:616
 msgid "Someone writes a followup comment"
 msgstr ""
 
-#: src/Module/Settings/Account.php:614
+#: src/Module/Settings/Account.php:617
 msgid "You receive a private message"
 msgstr ""
 
-#: src/Module/Settings/Account.php:615
+#: src/Module/Settings/Account.php:618
 msgid "You receive a friend suggestion"
 msgstr ""
 
-#: src/Module/Settings/Account.php:616
+#: src/Module/Settings/Account.php:619
 msgid "You are tagged in a post"
 msgstr ""
 
-#: src/Module/Settings/Account.php:617
+#: src/Module/Settings/Account.php:620
 msgid "You are poked/prodded/etc. in a post"
 msgstr ""
 
-#: src/Module/Settings/Account.php:619
+#: src/Module/Settings/Account.php:622
 msgid "Create a desktop notification when:"
 msgstr ""
 
-#: src/Module/Settings/Account.php:620
+#: src/Module/Settings/Account.php:623
 msgid "Someone tagged you"
 msgstr ""
 
-#: src/Module/Settings/Account.php:621
+#: src/Module/Settings/Account.php:624
 msgid "Someone directly commented on your post"
 msgstr ""
 
-#: src/Module/Settings/Account.php:622
+#: src/Module/Settings/Account.php:625
 msgid "Someone liked your content"
 msgstr ""
 
-#: src/Module/Settings/Account.php:622 src/Module/Settings/Account.php:623
+#: src/Module/Settings/Account.php:625 src/Module/Settings/Account.php:626
 msgid "Can only be enabled, when the direct comment notification is enabled."
 msgstr ""
 
-#: src/Module/Settings/Account.php:623
+#: src/Module/Settings/Account.php:626
 msgid "Someone shared your content"
 msgstr ""
 
-#: src/Module/Settings/Account.php:624
+#: src/Module/Settings/Account.php:627
 msgid "Someone commented in your thread"
 msgstr ""
 
-#: src/Module/Settings/Account.php:625
+#: src/Module/Settings/Account.php:628
 msgid "Someone commented in a thread where you commented"
 msgstr ""
 
-#: src/Module/Settings/Account.php:626
+#: src/Module/Settings/Account.php:629
 msgid "Someone commented in a thread where you interacted"
 msgstr ""
 
-#: src/Module/Settings/Account.php:628
+#: src/Module/Settings/Account.php:631
 msgid "Activate desktop notifications"
 msgstr ""
 
-#: src/Module/Settings/Account.php:628
+#: src/Module/Settings/Account.php:631
 msgid "Show desktop popup on new notifications"
 msgstr ""
 
-#: src/Module/Settings/Account.php:632
+#: src/Module/Settings/Account.php:635
 msgid "Text-only notification emails"
 msgstr ""
 
-#: src/Module/Settings/Account.php:634
+#: src/Module/Settings/Account.php:637
 msgid "Send text only notification emails, without the html part"
 msgstr ""
 
-#: src/Module/Settings/Account.php:638
+#: src/Module/Settings/Account.php:641
 msgid "Show detailled notifications"
 msgstr ""
 
-#: src/Module/Settings/Account.php:640
+#: src/Module/Settings/Account.php:643
 msgid ""
 "Per default, notifications are condensed to a single notification per item. "
 "When enabled every notification is displayed."
 msgstr ""
 
-#: src/Module/Settings/Account.php:644
+#: src/Module/Settings/Account.php:647
 msgid "Show notifications of ignored contacts"
 msgstr ""
 
-#: src/Module/Settings/Account.php:646
+#: src/Module/Settings/Account.php:649
 msgid ""
 "You don't see posts from ignored contacts. But you still see their comments. "
 "This setting controls if you want to still receive regular notifications "
 "that are caused by ignored contacts or not."
 msgstr ""
 
-#: src/Module/Settings/Account.php:649
+#: src/Module/Settings/Account.php:652
 msgid "Advanced Account/Page Type Settings"
 msgstr ""
 
-#: src/Module/Settings/Account.php:650
+#: src/Module/Settings/Account.php:653
 msgid "Change the behaviour of this account for special situations"
 msgstr ""
 
-#: src/Module/Settings/Account.php:653
+#: src/Module/Settings/Account.php:656
 msgid "Import Contacts"
 msgstr ""
 
-#: src/Module/Settings/Account.php:654
+#: src/Module/Settings/Account.php:657
 msgid ""
 "Upload a CSV file that contains the handle of your followed accounts in the "
 "first column you exported from the old account."
 msgstr ""
 
-#: src/Module/Settings/Account.php:655
+#: src/Module/Settings/Account.php:658
 msgid "Upload File"
 msgstr ""
 
-#: src/Module/Settings/Account.php:658
+#: src/Module/Settings/Account.php:661
 msgid "Relocate"
 msgstr ""
 
-#: src/Module/Settings/Account.php:659
+#: src/Module/Settings/Account.php:662
 msgid ""
 "If you have moved this profile from another server, and some of your "
 "contacts don't receive your updates, try pushing this button."
 msgstr ""
 
-#: src/Module/Settings/Account.php:660
+#: src/Module/Settings/Account.php:663
 msgid "Resend relocate message to contacts"
 msgstr ""
 
@@ -10992,16 +11029,16 @@ msgstr ""
 msgid "Login failed."
 msgstr ""
 
-#: src/Security/Authentication.php:267
+#: src/Security/Authentication.php:271
 msgid "Login failed. Please check your credentials."
 msgstr ""
 
-#: src/Security/Authentication.php:374
+#: src/Security/Authentication.php:382
 #, php-format
 msgid "Welcome %s"
 msgstr ""
 
-#: src/Security/Authentication.php:375
+#: src/Security/Authentication.php:383
 msgid "Please upload a profile photo."
 msgstr ""