Re: Password_hash salt generation refactor

On 19/10/15 00:59, Anthony Ferrara wrote:

I don't feel comfortable pulling against 7 this far into RC status. Perhaps wait until after it goes gold? Or should this target 7.1? It's not a big deal in either direction. Though it does add a side-effect, where if it can't gather enough entropy it will throw an exception and return failure (where prior it would simply make a "best effort". Thoughts? Anthony It's a clean patch. It doesn't really seem like a problem pulling it.

Korvin wrote:

+1 for 7.0.x security patch release, best effort sounds scary. This is a salt. It doesn't need to be cryptographically secure. Using php_rand()

there should pose no problem. I would actually include that into the patch (move old lines 154-156 into the FAILURE if).