From 032df175deaf1b1bd14ba57a670d1989cef99d4c Mon Sep 17 00:00:00 2001
From: Chris Hunt <chris.hunt@kasmweb.com>
Date: Fri, 10 Apr 2026 10:40:25 +0100
Subject: [PATCH] KASM-8264 Add password complexity

---
 public/js/index.js | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/public/js/index.js b/public/js/index.js
index 34cceed..c74aba3 100644
--- a/public/js/index.js
+++ b/public/js/index.js
@@ -224,7 +224,7 @@ async function pickSettings() {
   ]);
   let userPass = $('<div>', {class: 'form-group'}).append([
     $('<label>', {for: 'userPass'}).text('user@kasm.local Password: '),
-    $('<input>', {name: 'userPass', id: 'userPass', type: 'password', placeholder: 'required'}).prop('required',true)
+    $('<input>', {name: 'userPass', id: 'userPass', type: 'password', required: true, placeholder: 'required'})
   ]);
   let gpuOptions = [$('<option>', {value: 'disabled'}).text('Disabled')];
   for await (let card of Object.keys(gpus)) {
@@ -237,7 +237,12 @@ async function pickSettings() {
   let submit = $('<div>', {class: 'form-group'}).append([
     $('<input>', {name: 'submit', type: 'submit', value: 'Next', class: 'btn btn-default btn-ghost'})
   ]);
+  let passHint = $('<p>', {
+    id: 'pass-hint',
+    style: 'color: inherit;'
+  }).text('Passwords must be at least 8 characters and include uppercase, lowercase, a number, and a special character (!#$%^&*@).');
   fieldset.append([
+    passHint,
     adminPass,
     userPass,
     forceGpu,
@@ -248,8 +253,16 @@ async function pickSettings() {
   // Grab data and move to image selection
   form.on('submit', function (e) {
     e.preventDefault();
-    installSettings.adminPass = $('#adminPass').val();
-    installSettings.userPass = $('#userPass').val();
+    const passRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!#$%^&*@]).{8,}$/;
+    const adminPassVal = $('#adminPass').val();
+    const userPassVal = $('#userPass').val();
+    if (!passRegex.test(adminPassVal) || !passRegex.test(userPassVal)) {
+      $('#pass-hint').css('color', 'red');
+      return;
+    }
+    $('#pass-hint').css('color', 'inherit');
+    installSettings.adminPass = adminPassVal;
+    installSettings.userPass = userPassVal;
     installSettings.forceGpu = $('#forceGpu').val();
     pickImages(false);
   });