Req #55036 [Asn->Csd]: Have crypt() throw E_WARNING when salt parameter missing
Edit report at https://bugs.php.net/bug.php?id=55036&edit=1
ID: 55036
Updated by: yohgaki@php.net
Reported by: ss23 at ss23 dot geek dot nz
Summary: Have crypt() throw E_WARNING when salt parameter
missing
-Status: Assigned
+Status: Closed
Type: Feature/Change Request
Package: *Encryption and hash functions
PHP Version: Irrelevant
Assigned To: yohgaki
Block user comment: N
Private report: N
New Comment:
Warning is enabled in 7.0
Previous Comments:
------------------------------------------------------------------------
[2013-07-31 04:08:13] yohgaki@php.net
Users' PHP 5.5 or later should use password_hash()
http://php.net/manual/en/ref.password.php
It would be good idea raise E_WARNING, since crypt() w/o algo/hash produces very
weak hash.
------------------------------------------------------------------------
[2011-06-11 23:55:59] ss23 at ss23 dot geek dot nz
Another possible way to "fix" the security risk here would be to choose a sane
hash as a default. Now that they're built in, it shouldn't be a problem to do
this.
------------------------------------------------------------------------
[2011-06-11 21:00:55] ss23 at ss23 dot geek dot nz
Description:
------------
Currently, you can call crypt('foo') without any problems, however, given how
useless that is for anything, it's a security risk if someone was actually to do
this.
Test script:
---------------
<?php
crypt('foo');
Expected result:
----------------
Warning: crypt() expects at least 2 parameters, 1 given
Actual result:
--------------
Works fine
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=55036&edit=1
Thread (4 messages)