From ef03daf658db501ddce304a1d2d0cd59dc4a6c71 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Fri, 22 Jul 2016 09:57:28 +0200 Subject: [PATCH] Remove hashing of blowfish secret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New code doesn't have problems with longer secrets. Signed-off-by: Michal Čihař --- libraries/plugins/auth/AuthenticationCookie.php | 3 +-- test/classes/plugin/auth/AuthenticationCookieTest.php | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php index a052bde059..98d9835e05 100644 --- a/libraries/plugins/auth/AuthenticationCookie.php +++ b/libraries/plugins/auth/AuthenticationCookie.php @@ -600,8 +600,7 @@ class AuthenticationCookie extends AuthenticationPlugin if (empty($GLOBALS['cfg']['blowfish_secret'])) { return $this->_getSessionEncryptionSecret(); } else { - // apply md5() to work around too long secrets (returns 32 characters) - return md5($GLOBALS['cfg']['blowfish_secret']); + return $GLOBALS['cfg']['blowfish_secret']; } } diff --git a/test/classes/plugin/auth/AuthenticationCookieTest.php b/test/classes/plugin/auth/AuthenticationCookieTest.php index ec16b1d07d..538e57907b 100644 --- a/test/classes/plugin/auth/AuthenticationCookieTest.php +++ b/test/classes/plugin/auth/AuthenticationCookieTest.php @@ -1053,7 +1053,7 @@ class AuthenticationCookieTest extends PMATestCase $result = $method->invoke($this->object, null); $this->assertEquals( - md5('notEmpty'), + 'notEmpty', $result ); }