benedmunds/CodeIgniter-Ion-Auth — pull request #207 by michaelbrooks (2012-04-28 04:43:11+00:00)
Title: Bcrypt initialization happens several times

The bcrypt library was being loaded in hash_password() and hash_password_db(). In hash_password(), it is used for creating new password hashes, so it is passed the $rounds parameter when initialized. In hash_password_db(), it is only used to verify the password, so it is not given the $rounds parameter.

However, during a password change, one first verifies the supplied old password, which requires a call to hash_password_db(), and then generates the new password hash via hash_password(). Since the bcrypt library was already loaded, hash_password() does not reload it with the $rounds parameter. New password hashes are thus always created with $rounds=7, regardless of the config setting.

I just moved the bcrypt loading into the constructor for the model (I'm still only loading it if the hash method is set to bcrypt).