{"record":{"id":"b376320a9fd2165b","repo":"phacility/phabricator","slug":"you-must-choose-a-password","errorCode":null,"errorMessage":"You must choose a password.","messagePattern":"You must choose a password\\.","errorType":"validation","errorClass":"PhabricatorAuthPasswordException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/engine/PhabricatorAuthPasswordEngine.php","lineNumber":70,"sourceCode":"\n  public function getUpgradeHashers() {\n    return $this->upgradeHashers;\n  }\n\n  public function checkNewPassword(\n    PhutilOpaqueEnvelope $password,\n    PhutilOpaqueEnvelope $confirm,\n    $can_skip = false) {\n\n    $raw_password = $password->openEnvelope();\n\n    if (!strlen($raw_password)) {\n      if ($can_skip) {\n        throw new PhabricatorAuthPasswordException(\n          pht('You must choose a password or skip this step.'),\n          pht('Required'));\n      } else {\n        throw new PhabricatorAuthPasswordException(\n          pht('You must choose a password.'),\n          pht('Required'));\n      }\n    }\n\n    $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');\n    $min_len = (int)$min_len;\n    if ($min_len) {\n      if (strlen($raw_password) < $min_len) {\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The selected password is too short. Passwords must be a minimum '.\n            'of %s characters long.',\n            new PhutilNumber($min_len)),\n          pht('Too Short'));\n      }\n    }\n","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/engine/PhabricatorAuthPasswordEngine.php#L52-L88","documentation":"The non-skippable variant of the empty-password check in checkNewPassword(): the raw password is empty and $can_skip is false (e.g., password reset or mandatory change flows), so a password is simply required. 'Required' is exposed via getPasswordError() for form field decoration.","triggerScenarios":"Calling checkNewPassword($password, $confirm) (default $can_skip=false) or explicitly with false, where the password envelope opens to an empty string - blank submit on a mandatory password form.","commonSituations":"Password reset screens, admin-forced password changes, account minimum-policy enforcement, automated scripts passing an empty PhutilOpaqueEnvelope.","solutions":["Enter a non-empty password before submitting.","In API/CLI callers, validate strlen() on the raw input before invoking the engine.","Catch PhabricatorAuthPasswordException and map getPasswordError() ('Required') onto the password field."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Reject an empty password before invoking the engine\nif (!strlen($password->openEnvelope())) {\n  $e_password = pht('Required');\n  return $this->buildPasswordFormResponse($e_password);\n}","typeGuard":null,"tryCatchPattern":"try {\n  $engine->checkNewPassword($password, $confirm);\n} catch (PhabricatorAuthPasswordException $ex) {\n  $e_password = $ex->getPasswordError(); // 'Required'\n  // re-render the form with $e_password on the password field\n}","preventionTips":["Mark the password field required in every form that forbids skipping.","Validate non-empty input at the form layer; keep the engine check as the backstop.","In CLI/API callers, assert strlen() before constructing the envelope."],"tags":["phabricator","password","validation","empty-input","php"],"backgroundTag":"password-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}