{"action":"created","issue":{"url":"https://api.github.com/repos/panique/huge/issues/478","labels_url":"https://api.github.com/repos/panique/huge/issues/478/labels{/name}","comments_url":"https://api.github.com/repos/panique/huge/issues/478/comments","events_url":"https://api.github.com/repos/panique/huge/issues/478/events","html_url":"https://github.com/panique/huge/issues/478","id":40203258,"number":478,"title":"[3.2] limit password length to limit DoS attacks ?","user":{"login":"ghost","id":10137,"avatar_url":"https://avatars.githubusercontent.com/u/10137?v=3","gravatar_id":"","url":"https://api.github.com/users/ghost","html_url":"https://github.com/ghost","followers_url":"https://api.github.com/users/ghost/followers","following_url":"https://api.github.com/users/ghost/following{/other_user}","gists_url":"https://api.github.com/users/ghost/gists{/gist_id}","starred_url":"https://api.github.com/users/ghost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghost/subscriptions","organizations_url":"https://api.github.com/users/ghost/orgs","repos_url":"https://api.github.com/users/ghost/repos","events_url":"https://api.github.com/users/ghost/events{/privacy}","received_events_url":"https://api.github.com/users/ghost/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/panique/huge/labels/v3.0","name":"v3.0","color":"d4c5f9"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2014-08-13T21:51:08Z","updated_at":"2015-03-09T21:11:00Z","closed_at":"2015-03-09T21:11:00Z","body":"I dont Have A PoC but a similar bug bit Django last year.\r\n\r\nhttps://www.djangoproject.com/weblog/2013/sep/15/security/\r\n\r\nI think passwords should be capped at something reasonable like 9001 characters. "},"comment":{"url":"https://api.github.com/repos/panique/huge/issues/comments/77943472","html_url":"https://github.com/panique/huge/issues/478#issuecomment-77943472","issue_url":"https://api.github.com/repos/panique/huge/issues/478","id":77943472,"user":{"login":"panique","id":156321,"avatar_url":"https://avatars.githubusercontent.com/u/156321?v=3","gravatar_id":"","url":"https://api.github.com/users/panique","html_url":"https://github.com/panique","followers_url":"https://api.github.com/users/panique/followers","following_url":"https://api.github.com/users/panique/following{/other_user}","gists_url":"https://api.github.com/users/panique/gists{/gist_id}","starred_url":"https://api.github.com/users/panique/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/panique/subscriptions","organizations_url":"https://api.github.com/users/panique/orgs","repos_url":"https://api.github.com/users/panique/repos","events_url":"https://api.github.com/users/panique/events{/privacy}","received_events_url":"https://api.github.com/users/panique/received_events","type":"User","site_admin":false},"created_at":"2015-03-09T21:11:00Z","updated_at":"2015-03-09T21:11:00Z","body":"This can be closed, this problem does not exist, please see this for more information: http://stackoverflow.com/questions/28951359/is-phps-password-verify-safe-against-extremely-long-passwords-dos-attack"}}