svn: /phpdoc/de/trunk/reference/ outcontrol/functions/ob-implicit-flush.xml outcontrol/functions/ob-start.xml password/functions/password-hash.xml password/functions/password-needs-rehash.xml password/functions/password-verify.xml

Modified: phpdoc/de/trunk/reference/outcontrol/functions/ob-implicit-flush.xml
===================================================================
--- phpdoc/de/trunk/reference/outcontrol/functions/ob-implicit-flush.xml	2018-04-11 21:21:31 UTC (rev 344657)
+++ phpdoc/de/trunk/reference/outcontrol/functions/ob-implicit-flush.xml	2018-04-11 21:44:33 UTC (rev 344658)
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<!-- EN-Revision: 297028 Maintainer: hholzgra Status: ready -->
+<!-- EN-Revision: 343144 Maintainer: hholzgra Status: ready -->
+
   <refentry xml:id="function.ob-implicit-flush" xmlns="http://docbook.org/ns/docbook">
    <refnamediv>
     <refname>ob_implicit_flush</refname>
@@ -12,7 +13,7 @@
     &reftitle.description;
      <methodsynopsis>
       <type>void</type><methodname>ob_implicit_flush</methodname>
-      <methodparam choice="opt"><type>int</type><parameter>flag</parameter><initializer>true</initializer></methodparam>
+      <methodparam choice="opt"><type>int</type><parameter>flag</parameter><initializer>1</initializer></methodparam>
      </methodsynopsis>
     <para>
      <function>ob_implicit_flush</function> schaltet die implizite
@@ -31,7 +32,7 @@
        <term><parameter>flag</parameter></term>
        <listitem>
         <para>
-         &true; schaltet implizite Ausgabe ein, &false; schaltet sie aus.
+         <literal>1</literal> schaltet implizite Ausgabe ein, <literal>0</literal> schaltet sie aus.
         </para>
        </listitem>
       </varlistentry>

Modified: phpdoc/de/trunk/reference/outcontrol/functions/ob-start.xml
===================================================================
--- phpdoc/de/trunk/reference/outcontrol/functions/ob-start.xml	2018-04-11 21:21:31 UTC (rev 344657)
+++ phpdoc/de/trunk/reference/outcontrol/functions/ob-start.xml	2018-04-11 21:44:33 UTC (rev 344658)
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<!-- EN-Revision: 335401 Maintainer: theseer Status: ready -->
+<!-- EN-Revision: 341282 Maintainer: theseer Status: working -->
+
 <refentry xmlns="http://docbook.org/ns/docbook" xml:id="function.ob-start">
     <refnamediv>
         <refname>ob_start</refname>
@@ -170,7 +171,7 @@
                             <para>
                                 In PHP 4.0.4,
                                 <function>ob_gzhandler</function>
-                                was introduced to
+                                function exists to
                                 facilitate sending gz-encoded data to web browsers that support
                                 compressed web pages.
                                 <function>ob_gzhandler</function>

Modified: phpdoc/de/trunk/reference/password/functions/password-hash.xml
===================================================================
--- phpdoc/de/trunk/reference/password/functions/password-hash.xml	2018-04-11 21:21:31 UTC (rev 344657)
+++ phpdoc/de/trunk/reference/password/functions/password-hash.xml	2018-04-11 21:44:33 UTC (rev 344658)
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<!-- EN-Revision: 331550 Maintainer: nobody Status: ready -->
+<!-- EN-Revision: 343891 Maintainer: nobody Status: ready -->
 <!-- Reviewed: no -->

 <refentry xml:id="function.password-hash" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
@@ -14,11 +14,15 @@
   <methodsynopsis>
    <type>string</type><methodname>password_hash</methodname>
    <methodparam><type>string</type><parameter>password</parameter></methodparam>
-   <methodparam><type>integer</type><parameter>algo</parameter></methodparam>
+   <methodparam><type>int</type><parameter>algo</parameter></methodparam>
    <methodparam choice="opt"><type>array</type><parameter>options</parameter></methodparam>
   </methodsynopsis>
   <para>
    <function>password_hash</function> erstellt einen neuen Passwort-Hash und benutzt dabei einen starken Einweg-Hashing-Algorithmus.
+   <function>password_hash</function> ist kompatibel zu
+   <function>crypt</function>. Daher können Passwort-Hashes, die durch
+   <function>crypt</function> erzeugt wurden, mit
+   <function>password_hash</function> verwendet werden.
   </para>
   <simpara>
    Die folgenden Algorithmen werden zur Zeit unterstützt:
@@ -35,13 +39,22 @@
      <simpara>
       <constant>PASSWORD_BCRYPT</constant> - Benutzt den <constant>CRYPT_BLOWFISH</constant>-Algorithmus zum Erstellen des Hashes. Dies erstellt einen <function>crypt</function>-kompatiblen Hash und benutzt die "$2y$"-Kennung. Es wird immer ein 60 Zeichen langer String zurückgegeben, &return.falseforfailure;.
      </simpara>
+    </listitem>
+    <listitem>
+     <simpara>
+      <constant>PASSWORD_ARGON2I</constant> - Use the Argon2 hashing algorithm to create the hash.
+     </simpara>
+    </listitem>
+   </itemizedlist>
+  </para>
+  <simpara>
+   Unterstützte Optionen für <constant>PASSWORD_BCRYPT</constant>:
+  </simpara>
      <para>
-      Unterstützte Optionen:
-     </para>
      <itemizedlist>
       <listitem>
        <para>
-        <literal>salt</literal> - to manually provide a salt to use when hashing the password.
+        <literal>salt</literal> (<type>string</type>) - to manually provide a salt to use when hashing the password.
         Note that this will override and prevent a salt from being automatically generated.
        </para>
        <para>
@@ -48,10 +61,17 @@
         If omitted, a random salt will be generated by <function>password_hash</function> for
         each password hashed. This is the intended mode of operation.
        </para>
+       <warning>
+        <para>
+         Die salt Option wurde von PHP 7.0.0 an missbilligt. Es wird nun
+         empfohlen einfach das Salt zu verwenden, dass standardmäßig erzeugt
+         wird.
+        </para>
+       </warning>
       </listitem>
       <listitem>
        <para>
-        <literal>cost</literal> - which denotes the algorithmic cost that should be used.
+        <literal>cost</literal> (<type>integer</type>) - which denotes the algorithmic cost that should be used.
         Examples of these values can be found on the <function>crypt</function> page.
        </para>
        <para>
@@ -60,7 +80,30 @@
        </para>
       </listitem>
      </itemizedlist>
+  </para>
+  <simpara>
+   Supported options for <constant>PASSWORD_ARGON2I</constant>:
+  </simpara>
+  <para>
+   <itemizedlist>
+    <listitem>
+     <para>
+      <literal>memory_cost</literal> (<type>integer</type>) - Maximum memory (in bytes) that may
+      be used to compute the Argon2 hash. Defaults to <constant>PASSWORD_ARGON2_DEFAULT_MEMORY_COST</constant>.
+     </para>
     </listitem>
+    <listitem>
+     <para>
+      <literal>time_cost</literal> (<type>integer</type>) - Maximum amount of time it may
+      take to compute the Argon2 hash. Defaults to <constant>PASSWORD_ARGON2_DEFAULT_TIME_COST</constant>.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      <literal>threads</literal> (<type>integer</type>) - Number of threads to use for computing
+      the Argon2 hash. Defaults to <constant>PASSWORD_ARGON2_DEFAULT_THREADS</constant>.
+     </para>
+    </listitem>
    </itemizedlist>
   </para>
  </refsect1>
@@ -74,6 +117,14 @@
      <para>
       &password.parameter.password;
      </para>
+      <caution>
+       <para>
+        Die Verwendung von <constant>PASSWORD_BCRYPT</constant> als
+        Algorithmus führt dazu, dass der
+        <parameter>password</parameter> Parameter auf eine Höchstlänge von 72
+        Zeichen gekürzt wird.
+       </para>
+      </caution>
     </listitem>
    </varlistentry>
    <varlistentry>
@@ -104,6 +155,14 @@
   <para>
    Returns the hashed password, &return.falseforfailure;.
   </para>
+  <para>
+   Der verwendete Algorithmus, der Aufwand und das Salt werden als Teil des
+   Hashes zurückgegeben. Daher sind alle Informationen, die benötigt werden, um
+   den Hash zu verifizieren, darin enthalten. Dies erlaubt es der Funktion
+   <function>password_verify</function> den Hash zu überprüfen, ohne dass eine
+   separate Speicherung für das Salt oder die Algorithmus-Information
+   erforderlich ist.
+  </para>
  </refsect1>

  <refsect1 role="examples">
@@ -121,11 +180,11 @@
  * Beware that DEFAULT may change over time, so you would want to prepare
  * By allowing your storage to expand past 60 characters (255 would be good)
  */
-echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT)."\n";
+echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
 ?>
 ]]>
     </programlisting>
-    &example.outputs;
+    &example.outputs.similar;
     <screen>
 <![CDATA[
 $2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a
@@ -146,11 +205,11 @@
 $options = [
     'cost' => 12,
 ];
-echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options)."\n";
+echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);
 ?>
 ]]>
     </programlisting>
-    &example.outputs;
+    &example.outputs.similar;
     <screen>
 <![CDATA[
 $2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K
@@ -175,11 +234,11 @@
     'cost' => 11,
     'salt' => mcrypt_create_iv(22, MCRYPT_DEV_URANDOM),
 ];
-echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options)."\n";
+echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);
 ?>
 ]]>
     </programlisting>
-    &example.outputs;
+    &example.outputs.similar;
     <screen>
 <![CDATA[
 $2y$11$q5MkhSBtlsJcNEVsYh64a.aCluzHnGog7TQAKVmQwO9C8xb.t89F.
@@ -196,12 +255,13 @@
 /**
  * This code will benchmark your server to determine how high of a cost you can
  * afford. You want to set the highest cost that you can without slowing down
- * you server too much. 10 is a good baseline, and more is good if your servers
- * are fast enough.
+ * you server too much. 8-10 is a good baseline, and more is good if your servers
+ * are fast enough. The code below aims for ≤ 50 milliseconds stretching time,
+ * which is a good baseline for systems handling interactive logins.
  */
-$timeTarget = 0.2;
+$timeTarget = 0.05; // 50 Millisekunden

-$cost = 9;
+$cost = 8;
 do {
     $cost++;
     $start = microtime(true);
@@ -209,18 +269,36 @@
     $end = microtime(true);
 } while (($end - $start) < $timeTarget);

-echo "Appropriate Cost Found: " . $cost . "\n";
+echo "Appropriate Cost Found: " . $cost;
 ?>
 ]]>
     </programlisting>
-    &example.outputs;
+    &example.outputs.similar;
     <screen>
 <![CDATA[
-Appropriate Cost Found: 11
+Appropriate Cost Found: 10
 ]]>
     </screen>
    </example>
   </para>
+  <para>
+   <example>
+    <title><function>password_hash</function> example using Argon2</title>
+    <programlisting role="php">
+<![CDATA[
+<?php
+echo 'Argon2 hash: ' . password_hash('rasmuslerdorf', PASSWORD_ARGON2I);
+?>
+]]>
+    </programlisting>
+    &example.outputs.similar;
+    <screen>
+<![CDATA[
+Argon2 hash: $argon2i$v=19$m=1024,t=2,p=2$YzJBSzV4TUhkMzc3d3laeg$zqU/1IN0/AogfP4cmSJI1vc8lpXRW9/S0sYY2i2jHT0
+]]>
+    </screen>
+   </example>
+  </para>
  </refsect1>

  <refsect1 role="notes">
@@ -230,31 +308,36 @@
     It is strongly recommended that you do not generate your own salt for this function.
     It will create a secure salt automatically for you if you do not specify one.
    </para>
+   <para>
+    As noted above, providing the <literal>salt</literal> option in PHP 7.0
+    will generate a deprecation warning. Support for providing a salt manually
+    may be removed in a future PHP release.
+   </para>
   </caution>
   <note>
    <para>
-    It is recommended that you should test this function on your servers, and adjust the cost
-    parameter so that execution of the function takes approximately 0.1 to 0.5 seconds. The script
-    in the above example will help you choose a good cost value for your hardware.
+    It is recommended that you test this function on your servers, and adjust the cost parameter
+    so that execution of the function takes less than 100 milliseconds on interactive systems.
+    The script in the above example will help you choose a good cost value for your hardware.
    </para>
   </note>
   <note>
    <simpara>
     Updates to supported algorithms by this function (or changes to the default one) must follow
-    the follwoing rules:
+    the following rules:
    </simpara>
    <para>
     <itemizedlist>
      <listitem>
       <simpara>Any new algorithm must be in core for at least 1 full release of PHP prior to becoming
-       default. So if, for example, a new algorithm is added in 5.5.5, it would not be eligible for
-       default until 5.7 (since 5.6 would be the first full release). But if a different algorithm was
-       added in 5.6.0, it would also be eligible for default at 5.7.0.
+       default. So if, for example, a new algorithm is added in 7.5.5, it would not be eligible for
+       default until 7.7 (since 7.6 would be the first full release). But if a different algorithm was
+       added in 7.6.0, it would also be eligible for default at 7.7.0.
       </simpara>
      </listitem>
      <listitem>
       <simpara>
-       The default should only change on a full release (5.6.0, 6.0.0, etc) and not on a revision release.
+       The default should only change on a full release (7.3.0, 8.0.0, etc) and not on a revision release.
        The only exception to this is in an emergency when a critical security flaw is found in the current
        default.
       </simpara>
@@ -264,6 +347,30 @@
   </note>
  </refsect1>

+ <refsect1 role="changelog">
+  &reftitle.changelog;
+  <para>
+   <informaltable>
+    <tgroup cols="2">
+     <thead>
+      <row>
+       <entry>&Version;</entry>
+       <entry>&Description;</entry>
+      </row>
+     </thead>
+     <tbody>
+      <row>
+       <entry>7.2.0</entry>
+       <entry>
+        Support for Argon2 passwords using <constant>PASSWORD_ARGON2I</constant> was added.
+       </entry>
+      </row>
+     </tbody>
+    </tgroup>
+   </informaltable>
+  </para>
+ </refsect1>
+
  <refsect1 role="seealso">
   &reftitle.seealso;
   <para>

Modified: phpdoc/de/trunk/reference/password/functions/password-needs-rehash.xml
===================================================================
--- phpdoc/de/trunk/reference/password/functions/password-needs-rehash.xml	2018-04-11 21:21:31 UTC (rev 344657)
+++ phpdoc/de/trunk/reference/password/functions/password-needs-rehash.xml	2018-04-11 21:44:33 UTC (rev 344658)
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<!-- EN-Revision: 330609 Maintainer: nobody Status: ready -->
+<!-- EN-Revision: 343891 Maintainer: nobody Status: ready -->
 <!-- Reviewed: yes -->

 <refentry xml:id="function.password-needs-rehash" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
@@ -12,10 +12,10 @@
  <refsect1 role="description">
   &reftitle.description;
   <methodsynopsis>
-   <type>boolean</type><methodname>password_needs_rehash</methodname>
+   <type>bool</type><methodname>password_needs_rehash</methodname>
    <methodparam><type>string</type><parameter>hash</parameter></methodparam>
-   <methodparam><type>string</type><parameter>algo</parameter></methodparam>
-   <methodparam choice="opt"><type>string</type><parameter>options</parameter></methodparam>
+   <methodparam><type>int</type><parameter>algo</parameter></methodparam>
+   <methodparam choice="opt"><type>array</type><parameter>options</parameter></methodparam>
   </methodsynopsis>
   <para>
    Diese Funktion überprüft, ob der übergebene Hash den gleichen Algorithmus und die gleichen Optionen nutzt, wie in den übergebenen Optionen abgegeben. Falls nicht, wird angenommen, dass erneutes Hashen notwendig ist.
@@ -52,6 +52,40 @@
   </variablelist>
  </refsect1>

+
+ <refsect1 role="examples">
+  &reftitle.examples;
+  <para>
+   <example>
+    <title><function>password_needs_rehash()</function> Verwendungsbeispiel</title>
+    <programlisting role="php">
+<![CDATA[
+<?php
+
+$password = 'rasmuslerdorf';
+$hash = '$2y$10$YCFsG6elYca568hBi2pZ0.3LDL5wjgxct1N8w/oLR/jfHsiQwCqTS';
+
+// Der Aufwand-Parameter kann sich im Lauf der Zeit ändern, da die Hardware besser wird
+$options = array('cost' => 11);
+
+// Überprüfe den gespeicherten Hash gegen das Klartextkennwort
+if (password_verify($password, $hash)) {
+    // Prüfe ob ein neuerer Hash-Algorithmus verfügbar ist
+    // oder sich der Aufwand geändert hat
+    if (password_needs_rehash($hash, PASSWORD_DEFAULT, $options)) {
+        // Falls ja, dann erzeuge einen neuen Hash, und ersetze den alten
+        $newHash = password_hash($password, PASSWORD_DEFAULT, $options);
+    }
+
+    // Melde Nutzer an
+}
+?>
+]]>
+    </programlisting>
+   </example>
+  </para>
+ </refsect1>
+
  <refsect1 role="returnvalues">
   &reftitle.returnvalues;
   <para>

Modified: phpdoc/de/trunk/reference/password/functions/password-verify.xml
===================================================================
--- phpdoc/de/trunk/reference/password/functions/password-verify.xml	2018-04-11 21:21:31 UTC (rev 344657)
+++ phpdoc/de/trunk/reference/password/functions/password-verify.xml	2018-04-11 21:44:33 UTC (rev 344658)
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<!-- EN-Revision: 330568 Maintainer: nobody Status: ready -->
+<!-- EN-Revision: 343889 Maintainer: nobody Status: ready -->
 <!-- Reviewed: yes -->

 <refentry xml:id="function.password-verify" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
@@ -22,6 +22,9 @@
   <para>
    Beachte, dass <function>password_hash</function> den Algorithmus, den Aufwand und den Salt als Teil des Hashes zurückgibt. Somit sind alle benötigten Informationen im Hash enthalten, was der Funktion erlaubt den Hash zu prüfen, ohne dass Informationen über den Salt oder den Algorithmus an anderer Stelle gespeichert werden müssen.
   </para>
+  <para>
+   Diese Funktion ist vor Timing-Angriffen sicher.
+  </para>
  </refsect1>

  <refsect1 role="parameters">