From c8dc6db2a81dbe5165d548bcb181112aaa0fd52a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Sun, 23 Jan 2022 13:05:17 +0100
Subject: [PATCH] Remove entropy check on password

It is not a good way to enforce good password. It is better to include common
password with repetitive or sequential characters in the forbidden list.

issue11100
review376341002
---
 CHANGELOG                    | 1 +
 doc/topics/configuration.rst | 7 -------
 trytond/config.py            | 1 -
 trytond/res/message.xml      | 3 ---
 trytond/res/user.py          | 4 ----
 5 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 46f1873786..37d84368d8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Remove entropy check on password
 * Set view_id in the context when calling view_attributes
 * Add ip_address and device_cookie login method options
 * Add support for Python 3.10
diff --git a/doc/topics/configuration.rst b/doc/topics/configuration.rst
index 8b5446f819..c9cbd46044 100644
--- a/doc/topics/configuration.rst
+++ b/doc/topics/configuration.rst
@@ -497,13 +497,6 @@ forbidden
 
 The path to a file containing one forbidden password per line.
 
-entropy
-~~~~~~~
-
-The ratio of non repeated characters for the user password.
-
-Default: ``0.75``
-
 reset_timeout
 ~~~~~~~~~~~~~
 
diff --git a/trytond/config.py b/trytond/config.py
index 8c3130bd57..4974721ae6 100644
--- a/trytond/config.py
+++ b/trytond/config.py
@@ -88,7 +88,6 @@ class TrytonConfigParser(configparser.ConfigParser):
         self.set('session', 'ip_network_6', '56')
         self.add_section('password')
         self.set('password', 'length', '8')
-        self.set('password', 'entropy', '0.75')
         self.set('password', 'reset_timeout', str(24 * 60 * 60))
         self.add_section('bus')
         self.set('bus', 'allow_subscribe', 'False')
diff --git a/trytond/res/message.xml b/trytond/res/message.xml
index e09ca8fabc..aa1ac449a5 100644
--- a/trytond/res/message.xml
+++ b/trytond/res/message.xml
@@ -9,9 +9,6 @@ this repository contains the full copyright notices and license terms. -->
         <record model="ir.message" id="msg_password_forbidden">
             <field name="text">The password is forbidden.</field>
         </record>
-        <record model="ir.message" id="msg_password_entropy">
-            <field name="text">The same characters appear in the password too many times.</field>
-        </record>
         <record model="ir.message" id="msg_password_name">
             <field name="text">The password cannot be the same as user's name.</field>
         </record>
diff --git a/trytond/res/user.py b/trytond/res/user.py
index 773b3c3bbc..8b4c2daf57 100644
--- a/trytond/res/user.py
+++ b/trytond/res/user.py
@@ -295,10 +295,6 @@ class User(avatar_mixin(100, 'login'), DeactivableMixin, ModelSQL, ModelView):
                     f.fileno(), 0, access=mmap.ACCESS_READ)
                 if forbidden.find(password_b) >= 0:
                     raise PasswordError(gettext('res.msg_password_forbidden'))
-        entropy = config.getfloat('password', 'entropy', default=0)
-        if entropy:
-            if len(set(password)) / len(password) < entropy:
-                raise PasswordError(gettext('res.msg_password_entropy'))
         for user in users:
             # Use getattr to allow to use non User instances
             for test, message in [