Form Validation and the bahaviour when the field id NOT required

[eluser]WanWizard[/eluser]
I don't think this is a bug. Both password and password2 are not required, so it's perfectly fine to leave them blank. Rules only run when there is something to validate.

What you want is required to be conditional based on the value of some other field. For that, you have to extend the form validation library and modify the _execute() method. Or use a callback. There's an example of a 'required_if' callback here.