[php-src] Issue #8397: crypt() accepts invalid characters in salt

From: Date: Thu, 21 Apr 2022 13:02:46 +0000
Subject: [php-src] Issue #8397: crypt() accepts invalid characters in salt
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-241121@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/8397 Comment Author: cmb69 > From a user perspective, if I install Ubuntu's > [php7.4](https://packages.ubuntu.com/focal/php7.4) package, there's no way to tell which > version of crypt() is being used or has been linked against at built-time. It might be reasonable to expose this information somehow; maybe a constant (PHP_CRYPT_IMPL) or some entry in phpinfo(). > Besides, the *0 return to mark an error doesn't seem well documented anywhere and has been > pretty unexpected to me. The [documentation](https://www.php.net/manual/en/function.crypt.php#refsect1-function.crypt-returnvalues) states: > Returns the hashed string or a string that is shorter than 13 characters and is guaranteed to > differ from the salt on failure. Since strlen("*0") < 13, this is covered by the documentation.

« previous php.bugs (#241121) next »