search

ircmaxell / password_compat

Compatibility with the password_* functions that ship with PHP 5.5
MIT License
2.15k stars 421 forks source link

force integer type for algo and cost #79

Closed pine3ree closed 9 years ago

pine3ree commented 9 years ago

in password_needs_rehash or maybe also add type checking for $algo parameter as in password_hash

ircmaxell commented 9 years ago

I think I'd rather error if it's not numeric-ish (!is_numeric()) but this is good I guess. I'll merge.. Thanks!

nimasdj commented 9 years ago

@ircmaxell I think you should release a new version for this PR merged or delete all released versions to prevent confusion and all users just download dev-master.

ircmaxell commented 9 years ago

I didn't release a new version after merging because I wanted some time for people to use it in dev-master to get a real-world understanding of this change. I didn't intend for it to go 4 months.

As far as deleting all released versions, please don't be hyperbolic. The stable tags are always the correct ones to use. If a security issue comes in a new release will be pushed instantly. But for minor bug fixes like this I prefer to see some usage prior to calling it stable.