Weak account credentials via permissive password validation

Weak password requirements in atjiu pybbs 6.0.0 and earlier allow remote attackers to create accounts with easily guessed passwords. UserAdminController.update encrypts and saves any nonempty submitted password without applying a strength check, while the registration API omitted server-side strength validation. The admin update path requires administrative access, but public registration exposes the policy gap to unauthenticated remote users; the documented consequence is greater susceptibility of user-selected credentials to guessing and brute-force attacks.