[jan] Improve salt generation for Blowfish hashes.

horde · Mar 2, 2015 · d99e190 · d99e190
1 parent ebaa7a0
commit d99e190
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/framework/Auth/lib/Horde/Auth.php b/framework/Auth/lib/Horde/Auth.php
@@ -242,8 +242,8 @@ public static function getSalt($encryption = 'md5-hex', $seed = '',
 
         case 'crypt-blowfish':
             return $seed
-                ? substr(preg_replace('|^{crypt}|i', '', $seed), 0, 16)
-                : '$2$' . base64_encode(hash('md5', sprintf('%08X%08X%08X', mt_rand(), mt_rand(), mt_rand()), true)) . '$';
+                ? preg_replace('|^(?:{crypt})?(\$2.?\$(?:\d\d\$)?[0-9A-Za-z./]{22}).*|i', '$1', $seed)
+                : '$2$' . substr(base64_encode(hash('md5', sprintf('%08X%08X%08X', mt_rand(), mt_rand(), mt_rand()), true)), 0, 21) . '$';
 
         case 'crypt-md5':
             return $seed

diff --git a/framework/Auth/package.xml b/framework/Auth/package.xml
@@ -34,7 +34,7 @@
  </stability>
  <license uri="http://www.horde.org/licenses/lgpl21">LGPL-2.1</license>
  <notes>
-* 
+* [jan] Improve salt generation for Blowfish hashes.
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">
@@ -1005,7 +1005,7 @@
    <date>2015-01-08</date>
    <license uri="http://www.horde.org/licenses/lgpl21">LGPL-2.1</license>
    <notes>
-* 
+* [jan] Improve salt generation for Blowfish hashes.
    </notes>
   </release>
  </changelog>