EllisLab/CodeIgniter — pull request #3071 by quinnchr (2014-05-29 22:55:15+00:00)
Title: Bug/xor encode

This is in response to a security vulnerability that was reported. I'm able to confirm that xor_encode is vulnerable to a brute force attack where the encryption key can be revealed. Anyone using cookie-based session who doesn't have mcrypt installed is potentially vulnerable. Since a potential attacker can read the key, they can re-encode the session data at will, meaning privilege escalation and other further attacks are possible.

I've removed the xor_encode function, and the Encrypt library will now show an error if mcrypt isn't available. xor_decode is left alone so you can still re-encode any xor_encoded data properly. The docs also reflect the removal.

Pinging @derekjones for a quick review.