Tickets :: Comment on [#2863] Corrected handling of {SSHA} and {SMD5} salt

* Your Email Address
* Spam protection	Enter the letters below: . .. ..___..__ .___. \| \|\ / _/ [__) _/ \|/\\| \/ ./__.\| ./__.
Comment	> The attached patch fixes two real and one potential problem(s) with > the SSHA and SMD5 password schemes in Auth::getSalt(). > > +) When looking for the salt, be case-insentive to avoid problems when the > > scheme specification is in lower case (c.f. bug #2708). > > +) The format for both schemes is (in pseudo-code) > > base64_encode(hash(password . salt) . salt). getSalt() did return the > > the still encoded value when $seed was set, and a raw value when > > generating a new one. > > +) The size of the salt is not fixed. While OpenLDAP and Horde both appear > > to be using 4 byte salts, others may not. The only part of which we know > > the exact length is the hash (128 and 160 bits, respectively). Therefore, > > substr() needs to count from the beginning of the binary string, > not the end.
Attachment
Watch this ticket