Problem/Motivation

When checking if the password needs to be rehashed, PASSWORD_DEFAULT is provided as a parameter instead of the configured algorithm. If an alternate algorithm is configured, the password will always be rehashed even though not necessary.

Steps to reproduce

override the password.php service's arguments to provide a different algorithm (e.g. PASSWORD_ARGON2I

Proposed resolution

Update the value sent to password_rehash()

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork php_password-3334308

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

gapple created an issue. See original summary.

gapple opened merge request !1

gapple’s picture

gapple
he/they
Primary language English
commented
Title: needsRehash always checks against PASSWORD_DEFAULT » 3334308-needsrehash
Status: Active » Needs review
gapple’s picture

gapple
he/they
Primary language English
commented
Title: 3334308-needsrehash » needsRehash always checks against PASSWORD_DEFAULT

  • neclimdul committed 725c7e56 on 8.x-1.x authored by gapple 
    Issue #3334308: needsRehash always checks against PASSWORD_DEFAULT
neclimdul’s picture

neclimdul
He/Him
commented
Status: Needs review » Fixed

Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.