Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

For BCrypt password encoder indicated PHP 5.5 is required#2698

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
weaverryan merged 1 commit intosymfony:2.3frommasterkaos:improving_bcrypt
Jun 22, 2013

Conversation

masterkaos
Copy link
Contributor

QA
Doc fix?yes
New docs?no
Applies to2.3
Fixed tickets

Should indicate that PHP 5.5 is required for Bcrypt password encoding

@wouterj
Copy link
Member

This should not be put in the versionadded directive, instead put a caution directive after the into paragraph:

..caution::    This requires PHP 5.5 or ...

And are there any reasons you based this on 2.3 and not 2.2?

@masterkaos
Copy link
ContributorAuthor

Yes, version 2.2 did not require PHP 5.5 for bcrypt encoding but now 2.3 does

@masterkaos
Copy link
ContributorAuthor

For more info, in Symfony 2.2 it would try to use the password_hash function (available in PHP 5.5) if it didn't exist, it would fall back to an internal function to create the crypt. In 2.3 the fallback functionality was removed and now completely relies on the password_hash function and throws an exception if not found.
Here is the PR that removed the functionalitysymfony/symfony#7853

What I don't understand is why this BC break (especially considering 5.5 isn't even released yet) wasn't documented in the update notes, as people shouldn't have to go hunting for that info.

@stof
Copy link
Member

stof commentedJun 5, 2013

@masterkaos The bcrypt encoder can still be used in PHP 5.3 or 5.4 thanks to the password_compat library, as highlighted in this PR. this library is implementing the password_hash function in PHP for people not using 5.5 yet.
And we switched to it to avoid maintaining the bcrypt code ourselves again (especially as there was some issues in the implementation compared to the password_compat library).
And this is documented in the changelog of the security component:https://github.com/symfony/symfony/blob/2.3/src/Symfony/Component/Security/CHANGELOG.md#230

@masterkaos
Copy link
ContributorAuthor

I did eventually see it in the security changelog, but it would be nice if all of the changelogs would be aggregated to or linked fromhttps://github.com/symfony/symfony/blob/master/UPGRADE-2.3.md

Seems like it is too easy to miss something having to go through a bunch of different components looking at all of the changelogs independently, but I will keep that in mind for the future. And I realize it still can be used, but doesn't work "out of the box" < 5.5. A couple additional BC breaks I missed was a few other deprecated methods that were removed in 2.3 that were mentioned in the 2.0 to 2.1 upgrade notes but not in 2.2 to 2.3. (Mainly the twig field_* to form_*), and these twig functions did not appear in the deprecated section of the debug toolbar, however I admit this was my fault

weaverryan added a commit that referenced this pull requestJun 22, 2013
For BCrypt password encoder indicated PHP 5.5 is required
@weaverryanweaverryan merged commite4a2f01 intosymfony:2.3Jun 22, 2013
weaverryan added a commit that referenced this pull requestJun 22, 2013
@masterkaosmasterkaos deleted the improving_bcrypt branchFebruary 11, 2014 14:25
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

4 participants
@masterkaos@wouterj@stof@weaverryan

[8]ページ先頭

©2009-2025 Movatter.jp