photo/frontend — pull request #982 by oscherler (2012-10-02 22:49:14+00:00)
Title: Use bcrypt to store user passwords

[phpass](http://www.openwall.com/phpass/) is a public domain password hashing class that implements bcrypt if `CRYPT_BLOWFISH` is available (either through the system `crypt()`, Suhosin, or PHP 5.3) and falls back on an algorithm based on DES or MD5 otherwise. I included all the files of the phpass download to keep it as a whole, but only the PHP class is necessary;

This pull request breaks login when SimpleDB is used, because I’m not familiar with it and `getUserByEmailAndPassword()` in `DatabaseSimpleDb.php` needs to be modified to retrieve the user by email only, and then verify the hashed password, since the salt is stored with the password.

Since the salt is stored with the password, then there is nothing to do for #939.

See also [my comment](https://github.com/photo/frontend/issues/759#issuecomment-9034690) on #759.