Skip to content
Snippets Groups Projects
  1. Jun 27, 2017
  2. Jun 16, 2017
  3. Jun 14, 2017
  4. Jun 12, 2017
  5. Jun 08, 2017
  6. Jun 07, 2017
  7. Jun 06, 2017
  8. Jun 04, 2017
  9. Jun 02, 2017
  10. May 26, 2017
  11. May 25, 2017
  12. May 23, 2017
  13. May 21, 2017
  14. May 18, 2017
  15. May 15, 2017
  16. May 13, 2017
  17. May 12, 2017
  18. Apr 24, 2017
  19. Apr 19, 2017
    • Max-Julian Pogner's avatar
      PassHash.class.php: in case of brcrypt, use the most recent variant $2y$ · dd865c4c
      Max-Julian Pogner authored
      This change breaks compatibility with php 5.3.7, but a standing
      requirement for at least php 5.6 is declared in composer.json.
      
      If the php documentation is to be believed, this change increases
      security against pass-the-hash type attacks. (I do not have the knowledge
      to assess the security differences between $2a$ and $2y$).
      
      As a Sidenote: htpasswd shipped with apache2 2.4.10 (and probably,
      other versions), when used with the -B (=bcrypt) option, produces hashes
      marked with $2y$.
      
      Nonewithstanding the actual support or non-support of $2a$ by the
      apache2 'AuthUserFile' directive, the apache 2.4 documentation only
      asserts support for the $2y$ bcrypt variant.
      Therefore, this commit would make it possible for dokuwiki and apache2
      basic authentication to share the same password file, in the case when
      bcrypt is used.
      dd865c4c
    • David Surroca's avatar
      translation update · 6475ad44
      David Surroca authored
      6475ad44
Loading