Place limit on password protect directories function for cPanel

[dibarra]

Good day,

Currently cPanel does not limit people who place passwords on their directories. This is a problem since crypt() will only hash up to 8 characters:

"By taking the lowest 7 bits of each of the first eight characters of the key, a 56-bit key is obtained. This 56-bit key is used to encrypt repeatedly a constant string (usually a string consisting of all
zeros). The returned value points to the encrypted password, a series of 13 printable ASCII characters (the first two characters represent the salt itself). The return value points to static data whose
content is overwritten by each call."

This is extremely confusing and frustrating for users of cPanel software, since one would expect a full password to be used when it's specified. Please add either a limit or a warning to cPanel's Password Protect Directory page to ensure that people only enter 8 character passwords. Thanks.

[cPanelDavidG]

Good day,

Currently cPanel does not limit people who place passwords on their directories. This is a problem since crypt() will only hash up to 8 characters:

"By taking the lowest 7 bits of each of the first eight characters of the key, a 56-bit key is obtained. This 56-bit key is used to encrypt repeatedly a constant string (usually a string consisting of all
zeros). The returned value points to the encrypted password, a series of 13 printable ASCII characters (the first two characters represent the salt itself). The return value points to static data whose
content is overwritten by each call."

This is extremely confusing and frustrating for users of cPanel software, since one would expect a full password to be used when it's specified. Please add either a limit or a warning to cPanel's Password Protect Directory page to ensure that people only enter 8 character passwords. Thanks.

To clarify, on servers where the Tweak Setting "Use MD5 passwords with Apache" is set to "off" (which is no longer the default), the password should be limited to 8 characters even though longer passwords are accepted by crypt (just the 9th character and after are irrelevant to checking against crypt)?

References:
Password Formats - Apache HTTP Server
https://issues.apache.org/bugzilla/s...g.cgi?id=47573