EllisLab/CodeIgniter — pull request #3070 by quinnchr (2014-05-29 22:12:39+00:00)
Title: Removing xor_encode from Encrypt library

This is in response to a security vulnerability that was reported. I'm able to confirm that xor_encode is vulnerable to a brute force attack where the encryption key can be revealed. Anyone using cookie-based session who doesn't have mcrypt installed is potentially vulnerable. Since a potential attacker can read the key, they can re-encode the session data at will, meaning privilege escalation and other further attacks are possible.

I've removed the xor_encode function, and the Encrypt library will now show an error if mcrypt isn't available. xor_decode is left alone so you can still re-encode any xor_encoded data properly.

Pinging @derekjones for a quick review.