diff options
| author | Eli Collins <elic@assurancetechnologies.com> | 2011-06-22 17:36:15 -0400 |
|---|---|---|
| committer | Eli Collins <elic@assurancetechnologies.com> | 2011-06-22 17:36:15 -0400 |
| commit | b1a5216d2e9cbf46f5f4500c0a8f9489f3b6d24e (patch) | |
| tree | 26a9a26643791fa64f17f46c35c9776ec4e9c7ba | |
| parent | 649d32296e9ccdcae66d4c7e52dbe6eb3256f8b1 (diff) | |
| download | passlib-b1a5216d2e9cbf46f5f4500c0a8f9489f3b6d24e.tar.gz | |
PHPass now prefers portable hash over bsdi-crypt
| -rw-r--r-- | docs/lib/passlib.apps.rst | 8 | ||||
| -rw-r--r-- | passlib/apps.py | 4 |
2 files changed, 9 insertions, 3 deletions
diff --git a/docs/lib/passlib.apps.rst b/docs/lib/passlib.apps.rst index 833ca93..29be43c 100644 --- a/docs/lib/passlib.apps.rst +++ b/docs/lib/passlib.apps.rst @@ -110,7 +110,13 @@ It is found in a wide range of PHP applications, including Drupal and Wordpress. and implements an custom scheme called the "phpass portable hash" :class:`~passlib.hash.phpass` as a fallback. BCrypt is used as the default if support is available, - otherwise BSDI-Crypt will be used as the default. + otherwise the Portable Hash will be used as the default. + + .. versionchanged:: 1.5 + Now uses Portable Hash as fallback if BCrypt isn't available. + Previously used BSDI-Crypt as fallback + (per original PHPass implementation), + but it was decided PHPass is in fact more secure. .. data:: phpbb3_context diff --git a/passlib/apps.py b/passlib/apps.py index 59643bf..bc72ea4 100644 --- a/passlib/apps.py +++ b/passlib/apps.py @@ -85,10 +85,10 @@ postgres_context = LazyCryptContext(["postgres_md5"]) #phpass & variants #========================================================= phpass_context = LazyCryptContext( - schemes=["bcrypt", "bsdi_crypt", "phpass",], + schemes=["bcrypt", "phpass", "bsdi_crypt", ], #XXX: make this lazy as well? causes bcrypt hash to always get loaded - default="bcrypt" if hash.bcrypt.has_backend() else "bsdi_crypt", + default="bcrypt" if hash.bcrypt.has_backend() else "phpass", ) phpbb3_context = LazyCryptContext(["phpass"], phpass__ident="H") |