Yech. Fixed! 67337f1<https://github.com/afuna/dw-free/commit/67337f18ca89295f88f44b1ad02ed065098a224d>


On Fri, Apr 19, 2013 at 2:05 PM, Mark Smith <notifications@github.com>wrote:

> In cgi-bin/DW/EmailPost/Reply.pm:
>
> > +    $self->{props} = $props;
> > +
> > +    return 1;
> > +}
> > +
> > +sub dblog_opts {
> > +    return ( t => "reply" );
> > +}
> > +
> > +=head1 Class Methods
> > +
> > +=cut
> > +# Generates the hash to be used in the reply to address
> > +sub _hash {
> > +    my ( $class, $u, $ju, $ditemid, $dtalkid ) = @_;
> > +    return Digest::MD5::md5_hex( $ju->id . $ditemid . $dtalkid . $u->emailpost_auth );
>
> We really should leave MD5 behind, it's broken:
> http://en.wikipedia.org/wiki/Hash_function_security_summary
>
> I believe most people are moving to SHA256 these days, we should probably
> use that. (And this requires little change on your part, maybe an extra
> module on ours.)
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/dreamwidth/dw-free/pull/346/files#r3868320>
> .
>