selbyk/yii-user — pull request #2 by selbyk (2012-08-12 02:22:47+00:00)
Title: Implement password salts

In order to minimize the risk of passwords being cracked through rainbowtables, save user passwords in a salted hash to the database.

This change generates a random salt based on php's uniqid() function in UserModel::getNewSalt(). Overwrite this function to change the way a salt is generated.

The resulting hash is stored in the database along with the password, separated by a colon (:). Split the password field on the colom character to get the password hash and the salt used to generate the hash. You can then compare the hashed password to the user supplied password by first appending the salt to the unencrypted user supplied password, then hashing the unencrypted string.

Please test for yourself again before merging and releasing.