diff --git a/lib/Cake/Utility/Security.php b/lib/Cake/Utility/Security.php index d9185b466..86f93506e 100644 --- a/lib/Cake/Utility/Security.php +++ b/lib/Cake/Utility/Security.php @@ -277,7 +277,12 @@ class Security { $salt = vsprintf('$2a$%02d$%s', array(self::$hashCost, $salt)); } - if ($salt === true || strpos($salt, '$2a$') !== 0 || strlen($salt) < 29) { + $invalidCipher = ( + strpos($salt, '$2y$') !== 0 && + strpos($salt, '$2x$') !== 0 && + strpos($salt, '$2a$') !== 0 + ); + if ($salt === true || $invalidCipher || strlen($salt) < 29) { trigger_error(__d( 'cake_dev', 'Invalid salt: %s for %s Please visit http://www.php.net/crypt and read the appropriate section for building %s salts.',