From c42d6b15c367b3c14ced40ebdc01e4ecbb29c179 Mon Sep 17 00:00:00 2001
From: Elie De Brauwer <eliedebrauwer@gmail.com>
Date: Sat, 23 May 2020 17:00:59 +0200
Subject: [PATCH] SecurePasswordsAssignment: Fix output formatting

- When solving the solution (entering a correct password) then the 'Score: 4/4' does not start on a new line, instead it is glue to the Estimated cracking time line. As a solution the </br> is added as a suffix on that line (and successive lines).
- Maximum score is 4, not 5 (see also the assignment, and https://github.com/nulab/zxcvbn4j/blob/master/src/main/java/com/nulabinc/zxcvbn/TimeEstimates.java#L23 which is the origin of getScore() )
---
 .../secure_password/SecurePasswordsAssignment.java     | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java b/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java
index 2e8e63813..24bbf5bf2 100644
--- a/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java
+++ b/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java
@@ -55,17 +55,17 @@ public class SecurePasswordsAssignment extends AssignmentEndpoint {
         } else {
             output.append("<div style=\"background-color:green;width: 200px;border-radius: 12px;float: left;\">&nbsp;</div></br>");
         }
-        output.append("<b>Estimated cracking time: </b>" + calculateTime((long) strength.getCrackTimeSeconds().getOnlineNoThrottling10perSecond()));
+        output.append("<b>Estimated cracking time: </b>" + calculateTime((long) strength.getCrackTimeSeconds().getOnlineNoThrottling10perSecond()) + "</br>");
         if (strength.getFeedback().getWarning().length() != 0)
-            output.append("</br><b>Warning: </b>" + strength.getFeedback().getWarning());
+            output.append("<b>Warning: </b>" + strength.getFeedback().getWarning() + "</br>");
         // possible feedback: https://github.com/dropbox/zxcvbn/blob/master/src/feedback.coffee
         // maybe ask user to try also weak passwords to see and understand feedback?
         if (strength.getFeedback().getSuggestions().size() != 0) {
-            output.append("</br><b>Suggestions:</b></br><ul>");
+            output.append("<b>Suggestions:</b></br><ul>");
             for (String sug : strength.getFeedback().getSuggestions()) output.append("<li>" + sug + "</li>");
             output.append("</ul></br>");
         }
-        output.append("<b>Score: </b>" + strength.getScore() + "/5 </br>");
+        output.append("<b>Score: </b>" + strength.getScore() + "/4 </br>");
         output.append("<b>Estimated cracking time in seconds: </b>" + calculateTime((long) strength.getCrackTimeSeconds().getOnlineNoThrottling10perSecond()));
 
         if (strength.getScore() >= 4)
@@ -89,4 +89,4 @@ public class SecurePasswordsAssignment extends AssignmentEndpoint {
 
         return (years + " years " + days + " days " + hours + " hours " + minutes + " minutes " + sec + " seconds");
     }
-}
\ No newline at end of file
+}