Proftpd accept autentificate with password made by first 8 chars of the original password

Proftpd accept autentificate with password made by first 8 chars of the original password

Fixed in r1255 . I simply removed the salt argument from the "crypt()" call, because this way it will automatically generate an md5 salt stronger than the 2-chars algorithm previously used.

Replying to kilburn:

automatically generate an md5 salt stronger than the 2-chars algorithm previously used.

That's not correct. DES with 2 char-Salt is the default. Some systems use MD5 with 12 chars.

Debian (both etch and lenny) use md5 as system default hashing, so their php "crypt()" function also uses it. I don't really know about other distros but I suspect they're just the same.