Require PHP 5.3.7 in composer.json #51
Conversation
PHP 5.3.0 adds the bcrypt algorithm baked in. So this is a requirement. However in PHP 5.3.7 a security issue was fixed and the algorithm updated. So using anything below `5.3.7` is not an option for such a library aiming at security.
|
I disagree with this. If you are running a RHEL based distribution then they have back port most security issues to earlier versions (including the bcrypt one). For example, I am running 5.3.3 on Scientific Linux and the version_test.php script passes. |
|
Yeah good point with the branching, personally I hate it but in some cases its necessary. |
|
Really, this is a Wont-Fix, because there's no good way to fix it. Unfortunately, Composer won't let me run a test to determine compatibility, so I'm left with trusting users. I can either require that they don't use composer or that they understand what they are doing... Not to mention that a check like this can also fail, for example if they deploy (compile) from a > 5.3.7 host and deploy on a lesser one. So really, it comes down to developers need to take responsibility for their platforms... |
PHP 5.3.0 adds the bcrypt algorithm baked in. So this is a requirement.
However in PHP 5.3.7 a security issue was fixed and the algorithm updated. So
using anything below
5.3.7is not an option for such a library aiming atsecurity.