[#8327] - Consider removing JCryptCipherSimple
- Closed
- 11 Nov 2015
- Medium
- Build: master
- # 8327
XORing the plaintext with str_repeat($secretkey) is worse than encrypting in ECB mode.
There is no salvaging this "encryption" code. rm it, it's not secure.
mbabker
- 
That's good, but I would seriously consider throwing an E_NOTICE or E_WARNING whenever it's used as of 3.5.0.
zero-24
- | Category | ⇒ | Libraries |
| Labels |
Added:
?
|
||
We aren't going to place potentially publicly visible notices on people's sites. The deprecation is the best we can do until Joomla 4 (potentially we can shove something in the log files but the reality is that very very few people ever check that file). There are no active use cases of this class in core. So I think we're pretty much doing the best we can at this stage. Our Joomla 4 deprecations branch already has this class (and all use cases removed as well https://github.com/joomla-projects/joomla-pythagoras/tree/feature/deprecations)
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2015-11-11 01:44:20 |
| Closed_By | ⇒ | wilsonge |
JCryptCipherSimple is already deprecated and will be removed with 4.0.
Due to B/C it is still shiped but it's recommended to use one of the more secure alternatives.