Update hashing algorithm for passwords to SHA256

Previously hashes were computed as sha1(lower(username) . password), update this to add a layer of sha256 so that it becomes sha256(sha1(lower(username) . password) based on ideas by @jdarwood007.

The cookie password hash becomes sha256(password_hash . salt) instead of sha1(password_hash . salt), but the login hash remains same as before. This provides additional protection as someone with the hash from the database can't login directly simply by submitting that into the login form, they'd still need the original password to be able to login

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Use bcrypt for passwords and SHA-512 for cookies

Shift from sha256(sha1(lower(username) . password)) to password_hash(sha1(lower(username) . password), PASSWORD_BCRYPT) which is a PHP 5.5 implementation of a costly bcrypt based algorithm (added a back porting library as well which makes it compatible till minimum of PHP 5.3.7). This is much slower and more secure than a simple one pass sha256.

Also, the cookies are shifted from sha256(password . salt) to sha512(password . salt) to give them that extra spice of security.

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Move to simply bcrypt instead of bcrypt + sha1

bcrypting a sha1 hash is less secure than simply using bcrypt on a password. This also means that client side hashing is gone, as we cannot send hashed passwords and then use simple bcrypt. Ideally, client side hashing should be replaced by SSL which'd be more secure against SSL.

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix profile password verification

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Use UTF-8 safe strtolower for lowercasing usernames on login

Should potentially fix #1538

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Minor code cleanup

We don't need hash_verify and hash_simple functions anymore

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix the installer to work with bcrypt hashing

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix ssi_checkPassword

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix Admin and Moderate login

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Remove legacy login hash code

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix installer and upgrader

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Merge pull request #1674 from Dragooon/change-pwd-hash

Update hashing algorithm for passwords to BCrypt
Fix Package manager's mod lists

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix SQL error in MySQL upgrade

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Merge pull request #1700 from Dragooon/quick-fix

A couple of quick fixes
Fix Postgres and SQLite upgraders

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Merge pull request #1701 from Dragooon/quick-fix

Fix Postgres and SQLite upgraders
When logged out, the Welcome, please login or register text was too far up to the top. This commit fixes that.

Signed-off-by: Yoshi2889 <rick.2889@gmail.com>
Use regular hooking code for wrap action

This has several advantages
- Familiar, unified syntax
- Filename parameter can actually be used
- Not limited to bare functions; call class methods

Signed-off-by: John Rayes <live627@gmail.com>
Merge pull request #1702 from Yoshi2889/cssfix

Move "Please login or register" text down