[BUGFIX] stdWrap.hash: Return nothing for non-existing algorithm
authorStefan Neufeind <typo3.neufeind@speedpartner.de>
Thu, 14 Jul 2011 10:11:51 +0000 (12:11 +0200)
committerXavier Perseguers <typo3@perseguers.ch>
Thu, 14 Jul 2011 19:18:08 +0000 (21:18 +0200)
Return an empty string to prevent disclosing information unhashed.

Change-Id: Id25b85de039797aa7e39225fb0e2b1c75207a505
Resolves: #28120
Reviewed-on: http://review.typo3.org/3324
Reviewed-by: Jo Hasenau
Tested-by: Jo Hasenau
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
tests/typo3/sysext/cms/tslib/class.tslib_contentTest.php
typo3/sysext/cms/tslib/class.tslib_content.php

index 1543be3..c9d6fd0 100644 (file)
@@ -753,7 +753,7 @@ class tslib_contentTest extends tx_phpunit_testcase {
                                array(
                                        'hash' => 'non-existing'
                                ),
-                               'joh316'
+                               ''
                        ),
                        'testing stdWrap capability' => array(
                                'joh316',
index 9f2c334..8e77c18 100644 (file)
@@ -2328,6 +2328,9 @@ class tslib_cObj {
                                : $conf['hash'];
                if (function_exists('hash') && in_array($algorithm, hash_algos())) {
                        $content = hash($algorithm, $content);
+               } else {
+                               // non-existing hashing algorithm
+                       $content = '';
                }
                return $content;
        }