Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68399
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.173 as permitted sender)
MIME-Version: 1.0
Sender: kalle.php@gmail.com
In-Reply-To: <CAGa2bXZPwU=MNS3gvcsQK6uEfdTsbk8K9OMX7Y4ZUOUFCJy8HA@mail.gmail.com>
References: <CAGa2bXZPwU=MNS3gvcsQK6uEfdTsbk8K9OMX7Y4ZUOUFCJy8HA@mail.gmail.com>
Date: Wed, 7 Aug 2013 15:21:30 +0200
Message-ID: <CAJW__o0MnXwXL=J0MEKCAiY3767H_JZOud+7NzdHwMj1EdQbBA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] crypt() should raise error without 2nd parameter
From: kalle@php.net (Kalle Sommer Nielsen)

Hi Yasuo

2013/8/7 Yasuo Ohgaki <yohgaki@ohgaki.net>:
> Hi all,
>
> A user requested that crypt() should raise error without 2nd(slat)
> parameter.
>
> https://bugs.php.net/bug.php?id=55036
>
> crypt() without salt generates extremely weak password hash. In addition to
> this,
> PHP 5.5 has password_hash()
>
> This change should be applied from 5.5, IMHO.

This is a BC break, as the second parameter as noted is optional,
while I believe we can do it in 5.5, I don't think it is worth the
effort, neither to put a notice or similar (E_STRICT even), if the
second parameter is left out, and it should go in master instead which
I'm in favor of.



-- 
regards,

Kalle Sommer Nielsen
kalle@php.net