Psalm: password_hash argument n°2 = PASSWORD_DEFAULT

[williamdes]

ERROR: InvalidArgument - libraries/classes/InsertEdit.php:2622:51 - Argument 2 of password_hash expects int, string(2y) provided (see https://psalm.dev/004)
            $hash = password_hash($current_value, PASSWORD_DEFAULT);

I think this is wrong but I am not sure.

Valid for phpstan: https://phpstan.org/r/dd0e5ad1-fd44-473a-816c-7a692dedadfd
Valid for psalm: https://psalm.dev/r/ab10eabc02

Somewhat invalid in phpMyAdmin :thinking:

[psalm-github-bot[bot]]

I found these snippets:

https://psalm.dev/r/ab10eabc02

<?php declare(strict_types = 1);

echo password_hash('ok', PASSWORD_DEFAULT);

Psalm output (using commit 0d5d7c8):

No issues!

[weirdan]

Can you narrow it down on psalm.dev or in a separate repo?

[williamdes]

@weirdan I tried but impossible to do have it in another repo

This commit added it: https://github.com/phpmyadmin/phpmyadmin/commit/5ae6f1e16bd58d90d22be8b757e7b5f05874c85c
and https://github.com/phpmyadmin/phpmyadmin/commit/d5db17772984a4cb1c4e2121be15d3e70148a386 updated the baseline file to ignore the error.

I use php 8.0 but running 7.4 did not change the baseline.

---

Another unrelated bug (after I copy pasted over all my class (https://github.com/phpmyadmin/phpmyadmin/blob/master/libraries/classes/InsertEdit.php) at once onto https://psalm.dev/r/ab10eabc02 ):

[psalm-github-bot[bot]]

I found these snippets:

https://psalm.dev/r/ab10eabc02

<?php declare(strict_types = 1);

echo password_hash('ok', PASSWORD_DEFAULT);

Psalm output (using commit 0d5d7c8):

No issues!

[weirdan]

PASSWORD_* constants changed from int to string in PHP7.4: https://wiki.php.net/rfc/password_registry#backward_incompatible_changes

[weirdan]

@williamdes as a workaround, you may pass --php-version=7.4 CLI switch to Psalm which will get rid of this error. Psalm assumes the PHP version based on your composer constraints (for phpmyadmin it figures out 7.2), but uses the constant value from the currently running PHP runtime (7.4 for me).

[williamdes]

Thank you for the feedback, It makes sense now
I assume they changed the signature, everything works fine then.
it is added to the baseline until some fix is found