function can_process($new) {

	if (strlen($_POST['user_id']) < 4) {
		display_error( _('The user login entered must be at least 4 characters long.'));
		set_focus('user_id');
		return false;
	}
	if (!$new && ($_POST['password'] != '')) {
		if (strlen($_POST['password']) < 4) {
			display_error( _('The password entered must be at least 4 characters long.'));
			set_focus('password');
			return false;
		}
		if (strstr($_POST['password'], $_POST['user_id']) != false) {
			display_error( _('The password cannot contain the user login.'));
			set_focus('password');
			return false;
		}
	}

	return true;
}
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.