Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69738
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.42 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXYONaoxFBbmDx_vXQCpWSxPfLUsQJDKoQ3OCo1gDTcBwQ@mail.gmail.com>
References: <CAGa2bXaRkv2asU1bAwXTe=9s7o2njsqxG8W8gE9OtcG=8G4qqg@mail.gmail.com>
 <8C33E1D9-8689-4E81-A79B-644CB690DB64@gmail.com> <CAGa2bXbkcn+hN5k=MeeOR3MaOn2kW_M_sKkcwfnOxhng8=gc8Q@mail.gmail.com>
 <CAGa2bXYONaoxFBbmDx_vXQCpWSxPfLUsQJDKoQ3OCo1gDTcBwQ@mail.gmail.com>
Date: Tue, 22 Oct 2013 15:10:35 +0900
Message-ID: <CAGa2bXYjLhaPUkDYWH+iRGeQuNvtCEwSYDn74uDNtyKzBWMs3w@mail.gmail.com>
To: Alexey Zakhlestin <indeyets@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0158b878a845e804e94e44a0
Subject: Re: [PHP-DEV] [VOTE] Change crypt() behavior w/o salt
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0158b878a845e804e94e44a0
Content-Type: text/plain; charset=UTF-8

Hi all,

Any comments patch for this RFC?
Better E_NOTICE message is welcome.

diff --git a/UPGRADING b/UPGRADING
index b19c3dd..8f5033a 100755
--- a/UPGRADING
+++ b/UPGRADING
@@ -64,6 +64,10 @@ PHP X.Y UPGRADE NOTES
 4. Changed Functions
 ========================================

+- Standard:
+  crypt() without salt parameter raises E_NOTICE.
+  See https://wiki.php.net/rfc/crypt_function_salt
+
 - cURL:
   CURLOPT_SAFE_UPLOAD is now turned on by default and uploads with @file
   do not work unless it is explicitly set to false.
diff --git a/ext/standard/crypt.c b/ext/standard/crypt.c
index 113a5bd..eea6f78 100644
--- a/ext/standard/crypt.c
+++ b/ext/standard/crypt.c
@@ -272,6 +272,8 @@ PHP_FUNCTION(crypt)

  if (salt_in) {
  memcpy(salt, salt_in, MIN(PHP_MAX_SALT_LEN, salt_in_len));
+ } else {
+ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Weak hashed password is
generated without salt parameter");
  }

  /* The automatic salt generation covers standard DES, md5-crypt and
Blowfish (simple) */


Output:
[yohgaki@dev PHP-master]$ ./php-bin -d error_reporting=-1 -r
"crypt('asdfa');"
Notice: crypt(): Weak hashed password is generated without salt parameter
in Command line code on line 1


--
Yasuo Ohgaki
yohgaki@ohgaki.net


On Mon, Oct 7, 2013 at 5:51 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> Vote period is ended and the result was
>
> 0   Generate strong salt by default
> 12 Generate E_NOTICE error
> 2   Keep current behavior (Use weak hash)
>
> I'll prepare patch for it later.
>
> Thank you.
>
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
>
> On Wed, Sep 25, 2013 at 1:17 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> Hi Alexey,
>>
>> On Tue, Sep 24, 2013 at 11:22 PM, Alexey Zakhlestin <indeyets@gmail.com>wrote:
>>
>>> strangely, this RFC is not shown in "In voting phase" section here:
>>> https://wiki.php.net/rfc
>>> is that done manually?
>>>
>>
>> I should have done this.
>> Thank you for point it out.
>>
>> Regards,
>>
>> --
>> Yasuo Ohgaki
>> yohgaki@ohgaki.net
>>
>
>

--089e0158b878a845e804e94e44a0--