Closed (fixed)
Project:
Drupal core
Version:
7.x-dev
Component:
openid.module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
1 Sep 2008 at 14:32 UTC
Updated:
13 May 2009 at 07:30 UTC
Jump to comment: Most recent file
Comments
Comment #1
jax commentedhmac_hash generation is also in PHP5 http://www.php.net/manual/en/function.hash-hmac.php
Comment #2
c960657 commentedPatch no longer applies to HEAD.
Comment #3
c960657 commentedReroll.
Comment #4
chx commentedThis is a kitten killer patch. Using the new sha1 argument is one patch. And a good one. Making openid rely on hash extension is a different patch and one that would quickly get a won't fix.
Comment #5
jax commentedWell...
Not even if it's a default?
Comment #6
recidive commentedAlso,
"There is no installation needed to use these functions; they are part of the PHP core."
http://php.net/manual/en/hash.installation.php
Switching back to "needs review".
Comment #7
dries commentedThis looks like a good move to me, but I'd like to get chx's take on why he thinks it is a "Won't fix".
Comment #8
chx commentedWe really try to avoid relying on PHP extensions unless really necessary because they are a support burden. I blame every distribution out there that separates these out from their core -- but alas, they exist and they are widespread. You win less than 10 lines of code and get a support burden? No thanks. Feel free to add a
if (function_exists(hash_hmac))and use it inside our hmac but leave the workaround.Comment #9
dries commentedchx is is right. Let's start with a patch that uses sha1() and worry about hash_hmac() next. The former is guaranteed to be built-in, the later is most likely to be available (and might require a requirements check). Thanks for clarifying, chx.
Comment #10
recidive commentedOk, here's a patch for the sha1 function only.
Comment #11
dries commentedLooks good. I haven't committed it yet, because I don't know for sure whether the OpenID tests are sufficient.
Comment #12
c960657 commentedThe OPENID_SHA1_BLOCKSIZE constant is still used, so the define() should not be removed.
Tests for OpenID are awaiting review in #251245: openid.module needs tests. Until they are committed to CVS, you can apply the patch and run the tests locally.
Comment #13
recidive commentedRe-adding OPENID_SHA1_BLOCKSIZE constant.
I'll run tests, but I think we need to wait the tests patch to get in prior to commiting this one.
Comment #14
dries commentedCommitted to CVS HEAD. Thanks!