The user_pass_rehash() function now requires the user account ID to be passed in

The user_pass_rehash() function in Drupal 6 and 7 is used for generating time-dependent per-user links, for example one-time login links.

In Drupal 6.35 and Drupal 7.35, a new parameter was added to this function to fix security issues (see SA-CORE-2015-001); the user account ID should now be passed in.

Before:

$timestamp = REQUEST_TIME; // In Drupal 6, use time() instead.
$account = user_load($uid);
$hash = user_pass_rehash($account->pass, $timestamp, $account->login);

After:

$timestamp = REQUEST_TIME; // In Drupal 6, use time() instead.
$account = user_load($uid);
$hash = user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid);

If code is not updated for this change, Drupal will generate a PHP warning every time it is called. For backwards compatibility, the generated hash will still work correctly when it is possible to securely do so; however on some sites and in some situations the hashes will not work correctly until the code has been updated to pass in the user ID.