| 2571786c | 18-May-2017 |
LarsDW223 <lars_paulsen@web.de> |
always redirect to correct section
Across workflow 'show - sectionedit - save/cancel' explicitly transmit header id to the server. So the server can always redirect to the correct section even if he
always redirect to correct section
Across workflow 'show - sectionedit - save/cancel' explicitly transmit header id to the server. So the server can always redirect to the correct section even if headings have the same name. Fixes #1364.
show more ...
|
| dd865c4c | 08-Apr-2017 |
Max-Julian Pogner <max-julian@pogner.at> |
PassHash.class.php: in case of brcrypt, use the most recent variant $2y$
This change breaks compatibility with php 5.3.7, but a standing requirement for at least php 5.6 is declared in composer.json
PassHash.class.php: in case of brcrypt, use the most recent variant $2y$
This change breaks compatibility with php 5.3.7, but a standing requirement for at least php 5.6 is declared in composer.json.
If the php documentation is to be believed, this change increases security against pass-the-hash type attacks. (I do not have the knowledge to assess the security differences between $2a$ and $2y$).
As a Sidenote: htpasswd shipped with apache2 2.4.10 (and probably, other versions), when used with the -B (=bcrypt) option, produces hashes marked with $2y$.
Nonewithstanding the actual support or non-support of $2a$ by the apache2 'AuthUserFile' directive, the apache 2.4 documentation only asserts support for the $2y$ bcrypt variant. Therefore, this commit would make it possible for dokuwiki and apache2 basic authentication to share the same password file, in the case when bcrypt is used.
show more ...
|