Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69743
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kingsquare.nl from 141.138.142.202 cause and error)
MIME-Version: 1.0
In-Reply-To: <5266280A.7070303@php.net>
References: <CAGa2bXaRkv2asU1bAwXTe=9s7o2njsqxG8W8gE9OtcG=8G4qqg@mail.gmail.com>
 <8C33E1D9-8689-4E81-A79B-644CB690DB64@gmail.com> <CAGa2bXbkcn+hN5k=MeeOR3MaOn2kW_M_sKkcwfnOxhng8=gc8Q@mail.gmail.com>
 <CAGa2bXYONaoxFBbmDx_vXQCpWSxPfLUsQJDKoQ3OCo1gDTcBwQ@mail.gmail.com>
 <CAGa2bXYjLhaPUkDYWH+iRGeQuNvtCEwSYDn74uDNtyKzBWMs3w@mail.gmail.com> <5266280A.7070303@php.net>
Date: Tue, 22 Oct 2013 09:35:16 +0200
Message-ID: <CADq_CxqFjUyCYU0fQaeXnTS0Wi_vxoQUmuNYDaZt47x0EHcoKA@mail.gmail.com>
To: Joe Watkins <krakjoe@php.net>
Cc: PHP internals <internals@lists.php.net>, Yasuo Ohgaki <yohgaki@ohgaki.net>
Content-Type: multipart/alternative; boundary=047d7b5db26a56490a04e94f7267
Subject: Re: [PHP-DEV] [VOTE] Change crypt() behavior w/o salt
From: robin@kingsquare.nl ("Kingsquare.nl - Robin Speekenbrink")

--047d7b5db26a56490a04e94f7267
Content-Type: text/plain; charset=UTF-8

As a non-english speaker i'd like to throw my 2cents into the bag: Notice:
crypt(): weak hash generated due to lack of given salt in Command line code
on line 1

Regards,

Robin Speekenbrink


2013/10/22 Joe Watkins <krakjoe@php.net>

> On 10/22/2013 07:10 AM, Yasuo Ohgaki wrote:
>
>> Hi all,
>>
>> Any comments patch for this RFC?
>> Better E_NOTICE message is welcome.
>>
>> diff --git a/UPGRADING b/UPGRADING
>> index b19c3dd..8f5033a 100755
>> --- a/UPGRADING
>> +++ b/UPGRADING
>> @@ -64,6 +64,10 @@ PHP X.Y UPGRADE NOTES
>>   4. Changed Functions
>>   ==============================**==========
>>
>> +- Standard:
>> +  crypt() without salt parameter raises E_NOTICE.
>> +  See https://wiki.php.net/rfc/**crypt_function_salt<https://wiki.php.net/rfc/crypt_function_salt>
>> +
>>   - cURL:
>>     CURLOPT_SAFE_UPLOAD is now turned on by default and uploads with @file
>>     do not work unless it is explicitly set to false.
>> diff --git a/ext/standard/crypt.c b/ext/standard/crypt.c
>> index 113a5bd..eea6f78 100644
>> --- a/ext/standard/crypt.c
>> +++ b/ext/standard/crypt.c
>> @@ -272,6 +272,8 @@ PHP_FUNCTION(crypt)
>>
>>    if (salt_in) {
>>    memcpy(salt, salt_in, MIN(PHP_MAX_SALT_LEN, salt_in_len));
>> + } else {
>> + php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Weak hashed password is
>> generated without salt parameter");
>>    }
>>
>>    /* The automatic salt generation covers standard DES, md5-crypt and
>> Blowfish (simple) */
>>
>>
>> Output:
>> [yohgaki@dev PHP-master]$ ./php-bin -d error_reporting=-1 -r
>> "crypt('asdfa');"
>> Notice: crypt(): Weak hashed password is generated without salt parameter
>> in Command line code on line 1
>>
>>
>> --
>> Yasuo Ohgaki
>> yohgaki@ohgaki.net
>>
>>
>> On Mon, Oct 7, 2013 at 5:51 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>>
>>  Hi all,
>>>
>>> Vote period is ended and the result was
>>>
>>> 0   Generate strong salt by default
>>> 12 Generate E_NOTICE error
>>> 2   Keep current behavior (Use weak hash)
>>>
>>> I'll prepare patch for it later.
>>>
>>> Thank you.
>>>
>>>
>>> --
>>> Yasuo Ohgaki
>>> yohgaki@ohgaki.net
>>>
>>>
>>> On Wed, Sep 25, 2013 at 1:17 PM, Yasuo Ohgaki <yohgaki@ohgaki.net>
>>> wrote:
>>>
>>>  Hi Alexey,
>>>>
>>>> On Tue, Sep 24, 2013 at 11:22 PM, Alexey Zakhlestin <indeyets@gmail.com
>>>> >wrote:
>>>>
>>>>  strangely, this RFC is not shown in "In voting phase" section here:
>>>>> https://wiki.php.net/rfc
>>>>> is that done manually?
>>>>>
>>>>>
>>>> I should have done this.
>>>> Thank you for point it out.
>>>>
>>>> Regards,
>>>>
>>>> --
>>>> Yasuo Ohgaki
>>>> yohgaki@ohgaki.net
>>>>
>>>>
>>>
>>>
>>  The wording is not very good/does not make sense:
>
> Notice: crypt(): weak hash generated without salt in Command line code on
> line 1
>
> Cheers
> Joe
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--047d7b5db26a56490a04e94f7267--