Fri, 10 Apr 2026 13:26:31 +0000 https://bugs.horde.org/ticket/9121 decrypted password issue (DIGEST-MD5) Dear Horde Team, According to: http://www.php.net/manual/en/function.mcrypt-generic.php A stored password may be padded with \0, if it's length is not the same as the block size (8 chars). This feature is used by Crypt::Blowfish, which is used again by Horde::Secret to store password used to do DIGEST-MD5 Authentication. I've attached a patch which check the length of the encrypted message. Fri, 02 Jul 2010 07:15:16 +0000 https://bugs.horde.org/ticket/9121#t59300 This second patch is even simpler/better. Fri, 02 Jul 2010 08:06:06 +0000 https://bugs.horde.org/ticket/9121#t59301 Changes have been made in Git for this ticket: Bug #9121: Remove null padding on stored data http://git.horde.org/diff.php/framework/Secret/lib/Horde/Secret.php?rt=horde-git&r1=271ce27ceee4749c667b3d0b51be8947c915472d&r2=3db5893ecb72a2f35b73ece266e26594b8045f78 Fri, 02 Jul 2010 17:45:19 +0000 https://bugs.horde.org/ticket/9121#t59304