PHP8.1 E_DEPRECATED in PasswordHash::gensalt_blowfish

[hanshenrik]

since PHP8.1, PasswordHash::gensalt_blowfish risk getting E_DEPRECATED errors like

Deprecated: Implicit conversion from float 48.8 to int loses precision

in

$output .= chr((ord('0') + $this->iteration_count_log2 / 10));

the fix is simple, change it from implicit conversion to explicit conversion:

$output .= chr((int)((ord('0') + $this->iteration_count_log2 / 10)));

trac: https://core.trac.wordpress.org/ticket/56340

fix PHP>=8.1 E_DEPRECATED: Deprecated: Implicit conversion from float 48.8 to int loses precision

Trac ticket: https://core.trac.wordpress.org/ticket/56340

[hanshenrik]

updated diff

[jrf]

Fix looks good, but it would be good to have a test to safeguard this fix.

[desrosj]

The class being updated in the patches is ​technically an external library, though WordPress has made some changes to it over time (see the description of #51549).

I believe that the original intent of PHPass was to properly support password hashing on PHP < 5.5, which no longer applies to WordPress. But moving off of PHPass is a much larger discussion currently being had in #50027 and #21022.

This one off adjustment should be fine to make in the meantime, provided a few tests are added.

[audrasjb]

With WP 6.1 RC 1 scheduled tomorrow (Oct 10, 2022), there is not much time left to address this ticket. Given it still needs unit tests, let's move this ticket to 6.2.

Ps: if you were about to send a patch and if you feel it is realistic to commit it in the next few hours, please feel free to move this ticket back to milestone 6.1.

In PHP 8.1, PasswordHash::gensalt_blowfish() threw a deprecation notice for "Implicit conversation from float to int loses precision".

This change uses an (int) cast to prevent the deprecation notice.

Trac ticket: https://core.trac.wordpress.org/ticket/56340

[costdev]

I've added a test to both validate and safeguard this fix. I've pinged Sergey and Juliette on the PR to get their thoughts on the implementation.

[costdev]

See ​this comment, where the discussion is that the fix itself seems ready to go, and myself and Juliette will meet in mid-March to go through improving/adding to the tests. For now, this initial added test goes some way to show that the fix prevents the deprecation notice.

Adding for commit consideration.

[audrasjb]

In 55310:

External Libraries: Prevent a PHP 8.1 deprecation notice in PasswordHash::gensalt_blowfish().

This changeset uses an (int) cast to prevent a PHP 8.1 deprecation notice for "Implicit conversation from float to int loses precision" in PasswordHash::gensalt_blowfish().

Props hanshenrik, jrf, desrosj, costdev.
Fixes #56340.

[SergeyBiryukov]

In 55313:

Tests: Move PasswordHash test file to a more appropriate place.

While also used for post passwords and application passwords, the PasswordHash library appears to be initially introduced and primarily used for user passwords, so the test file can be moved to the user directory.

Follow-up to [6350], [55310].

See #56340.

Committed in https://core.trac.wordpress.org/changeset/55310.