Limit decrypt to 256 characters

[luigifab]

Description

Limit decrypt to 256 characters. This fix #2245.
In production since 3 months.

OpenMage 20.0.16 / PHP 8.0.25

Contribution checklist

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All automated tests passed successfully (all builds are green)

[elidrissidev]

Note that Mage_Core_Helper_Data::validateHash may be used in many places including third-party extensions, it it really safe to assume every "password" must be less than 256 chars?

[luigifab]

By default it is also used by admin user password validation.
For us, this is not used by our third-party extensions, and we haven't see problems.

[sreichel]

Note that Mage_Core_Helper_Data::validateHash may be used in many places including third-party extensions, it it really safe to assume every "password" must be less than 256 chars?

Do you or your code uses a password longer 256 chars?

[sreichel]

Mhhh, better use a new constant?

Mage_Customer_Model_Customer::MAXIMUM_PASSWORD_LENGTH was not my best choice.

[kiatng]

Mhhh, better use a new constant?

Mage_Customer_Model_Customer::MAXIMUM_PASSWORD_LENGTH was not my best choice.

You are right. May be add Mage_Core_Model_App::ABSOLUTE_MAX_PASSWORD_LENGTH

[elidrissidev]

Do you or your code uses a password longer 256 chars?

A hash is not necessary used for a password, can be any other value.

[sreichel]

A hash is not necessary used for a password, can be any other value.

True , buts only used to validate passwords (and one api-key) in ...

• Mage_Admin_Model_User
• Mage_Api_Model_User
• Mage_Customer_Model_Customer

[fballiano]

ok by me, let's wait for @sreichel to un-block his change request

.

[sreichel]

done

[fballiano]

merged and cherrypicked to v20