note 61958 rejected from ref.crack by nlopess
| From: | nlopess@php.net | Date: | Thu, 16 Feb 2006 11:15:41 +0000 |
| Subject: | note 61958 rejected from ref.crack by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-103837@lists.php.net to get a copy of this message | ||
Note Submitter: sheryl at gwu dot edu
----
Looking at the code for both ext/crack (PHP 4.4.2) and cracklib (2.8.6) itself, I noticed that
there's no way to pass a userID to cracklib. The getuid() call in fascist.c is going to get
the UID for the process running the http daemon.. That makes the Gecos checks mostly useless; and
while they may turn up, none of the "based on password entry" or "based on user
name" or "you are not in the password file" messages should be trusted.