Re: note 61958 rejected and deleted from ref.crack by notes editor nlopess

You guys can do what you like of course, but I didn't consider this email either a bug report *or* a request for new features. You had included two contradictory postings about what error messages people would see from this routine. I was trying to explain what the real case was. Sheryl --

Sheryl Coppenger    SEAS Computing Facility Staff      sheryl@gwu.edu
                    The George Washington University   (202) 994-6853
                    http://www.seas.gwu.edu/~sheryl

On Thu, 16 Feb 2006, php-notes@lists.php.net wrote:

Date: Thu, 16 Feb 2006 03:15:43 -0800 From: php-notes@lists.php.net To: sheryl@gwu.edu Subject: note 61958 rejected and deleted from ref.crack by notes editor

    nlopess

You are receiving this email because your note posted to the online PHP manual has been removed by one of the editors. Read the following paragraphs carefully, because they contain pointers to resources better suited for requesting support or reporting bugs, none of which are to be included in manual notes because there are mechanisms and groups in place to deal with those issues. The user contributed notes are not an appropriate place to ask questions, report bugs or suggest new features; please use the resources listed on <http://php.net/support> for those purposes. This was clearly stated in the page you used to submit your note, please carefully re-read those instructions before submitting future contributions. Bug submissions and feature requests should be entered at <http://bugs.php.net/>. For documentation errors use the bug system, and classify the bug as "Documentation problem". Support and ways to find answers to your questions can be found at <http://php.net/support>. Your note has been removed from the online manual. ----- Copy of your note below ----- Looking at the code for both ext/crack (PHP 4.4.2) and cracklib (2.8.6) itself, I noticed that there's no way to pass a userID to cracklib. The getuid() call in fascist.c is going to get the UID for the process running the http daemon.. That makes the Gecos checks mostly useless; and while they may turn up, none of the "based on password entry" or "based on user name" or "you are not in the password file" messages should be trusted.