Increased salt size.

fixes #286
2026-10-17 05:41:25 +02:00 · 2012-07-03 11:06:26 +02:00
parent c1c67a013b
commit 910b336dc7
1 changed files with 3 additions and 1 deletions
@@ -118,7 +118,9 @@ class User(DUser):
        # (b) supports passwords lengths of more than 8 characters (all except
        #     "crypt").
        elif scheme == "md5crypt":
-            salt = "".join(Random().sample(string.letters + string.digits, 2))
+            # The salt may vary from 12 to 48 bits. (Using all six bytes here
+            # with a subset of characters means we get only 35 random bits.)
+            salt = "".join(Random().sample(string.letters + string.digits, 6))
            result = md5crypt(raw_value, salt)
            prefix = "" # the result already has $1$ prepended to it to signify what this is
        elif scheme == "sha256":