Page MenuHomePhabricator

Change password_hash() algorithm from CRYPT_BLOWFISH to PASSWORD_BCRYPT.
ClosedPublic

Authored by wenyu on Apr 18 2014, 8:36 PM.

Details

Summary

PHP 5.5 specifies constant PASSWORD_BCRYPT should be used in password_hash()
instead of CRYPT_BLOWFISH. Using CRYPT_BLOWFISH is not supported in either PHP
or HHVM. This constant breaks Username / Password authentication.

Test Plan

Login using Username/Password with bcrypt hash. Before applying the patch,
No matter what password entered, it will always fail authentication. After this
patch, user should be able to login with bcrypt hash.

Diff Detail

Repository
rP Phabricator
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

wenyu retitled this revision from to Change password_hash() algorithm from CRYPT_BLOWFISH to PASSWORD_BCRYPT..
wenyu updated this object.
wenyu edited the test plan for this revision. (Show Details)
wenyu added reviewers: epriestley, btrahan.
epriestley edited edge metadata.

Thanks! On my system (Zend PHP 5.5.8 on OS X), these constants both have value 1, which is how I missed this originally.

This revision is now accepted and ready to land.Apr 18 2014, 8:38 PM
epriestley updated this revision to Diff 20907.

Closed by commit rPba956711a56b (authored by @wenyu, committed by @epriestley).