Mailing-List: contact bugs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache HTTPD Bugs Notification List" <bugs@httpd.apache.org>
From: bugzilla@apache.org
To: bugs@httpd.apache.org
Subject: DO NOT REPLY [Bug 46152] access allowed if password matches first
 seven characters of real password
In-Reply-To: <bug-46152-7868@https.issues.apache.org/bugzilla/>
References: <bug-46152-7868@https.issues.apache.org/bugzilla/>
Auto-Submitted: auto-generated
Content-Type: text/plain; charset="UTF-8"
MIME-Version: 1.0
Message-Id: <20090618115415.B73EF234C045@brutus.apache.org>
Date: Thu, 18 Jun 2009 04:54:15 -0700 (PDT)

https://issues.apache.org/bugzilla/show_bug.cgi?id=46152


Dan Poirier <poirier@pobox.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |NEEDINFO


--- Comment #1 from Dan Poirier <poirier@pobox.com>  2009-06-18 04:54:14 PST ---
The doc for htpasswd on 2.2 and trunk does say that when encrypted using
crypt() (the default), only the first 8 characters of the password are used. 
That might have been added since your bug report, I don't know. 

Are you sure it's 7 and not 8 characters?  Both the htpasswd doc, and the
crypt(3) man page, say that 8 characters are used.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org