Update hashing algorithm for passwords to SHA256

Previously hashes were computed as sha1(lower(username) . password), update this to add a layer of sha256 so that it becomes sha256(sha1(lower(username) . password) based on ideas by @jdarwood007.

The cookie password hash becomes sha256(password_hash . salt) instead of sha1(password_hash . salt), but the login hash remains same as before. This provides additional protection as someone with the hash from the database can't login directly simply by submitting that into the login form, they'd still need the original password to be able to login

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Use bcrypt for passwords and SHA-512 for cookies

Shift from sha256(sha1(lower(username) . password)) to password_hash(sha1(lower(username) . password), PASSWORD_BCRYPT) which is a PHP 5.5 implementation of a costly bcrypt based algorithm (added a back porting library as well which makes it compatible till minimum of PHP 5.3.7). This is much slower and more secure than a simple one pass sha256.

Also, the cookies are shifted from sha256(password . salt) to sha512(password . salt) to give them that extra spice of security.

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Move to simply bcrypt instead of bcrypt + sha1

bcrypting a sha1 hash is less secure than simply using bcrypt on a password. This also means that client side hashing is gone, as we cannot send hashed passwords and then use simple bcrypt. Ideally, client side hashing should be replaced by SSL which'd be more secure against SSL.

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix profile password verification

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Use UTF-8 safe strtolower for lowercasing usernames on login

Should potentially fix #1538

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Minor code cleanup

We don't need hash_verify and hash_simple functions anymore

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix the installer to work with bcrypt hashing

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix ssi_checkPassword

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix Admin and Moderate login

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Remove legacy login hash code

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix installer and upgrader

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Merge pull request #1674 from Dragooon/change-pwd-hash

Update hashing algorithm for passwords to BCrypt