[ticket/14733] Support increasing hashing cost factor #4405

Open
wants to merge 2 commits into
from

3 participants

@marc1706
phpBB Forum Software member
marc1706 commented Aug 9, 2016 edited

This will need another pull request for 3.2.x.

Checklist:

  • Correct branch: master for new features; 3.2.x, 3.1.x for fixes
  • Tests pass
  • Code follows coding guidelines: master / 3.2.x, 3.1.x
  • Commit follows commit message format

Tracker ticket (set the ticket ID to your ticket ID):

https://tracker.phpbb.com/browse/PHPBB3-14733

PHPBB3-14733

@marc1706 marc1706 added this to the 3.1.10 milestone Aug 9, 2016
@bantu bantu commented on the diff Aug 22, 2016
phpBB/phpbb/passwords/driver/driver_interface.php
@@ -30,6 +30,14 @@ public function is_supported();
public function is_legacy();
/**
+ * Check if password needs to be rehashed
+ *
+ * @param string $hash Hash to check for rehash
+ * @return bool True if password needs to be rehashed, false if not
+ */
+ public function needs_rehash($hash);
@bantu
phpBB Forum Software member
bantu added a line comment Aug 22, 2016

Breaks other existing interface implementations, thus can not go into 3.1.x?

@marc1706
phpBB Forum Software member
marc1706 added a line comment Aug 23, 2016

As all drivers are extending the base class this shouldn't cause any BC breaks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
@bantu
phpBB Forum Software member

This can not go into 3.1.x because of #4405 (comment). Additionally, it should not go into a stable branch because it is basically a new feature (with the usual possibility of regression/breaks).

@marc1706
phpBB Forum Software member

I'm ok with moving this to 3.2.x as target. It shouldn't cause any BC breaks as it's using the abstract base class for an implementation of the de-facto state of the current convert flag. I do however understand that this is basically a new feature so I guess it's fair to have this moved to a 3.2.x target.

@Nicofuma agree?

@Nicofuma
phpBB Forum Software member

👍 for 3.2.1 or 3.3.0 (we really need to define what we accept in each kind of release)

@bantu
phpBB Forum Software member

@marc1706 An extension might implement driver_interface, no?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment