ionize/ionize — pull request #71 by GWRon (2013-04-06 17:29:05+00:00)
Title: Remember-Me-function, hardened password storage, cleanups, prepared forgotten-password-handling

Hi, as I have stated in my email from some days ago:
IonizeCMS has some security flaws. This patch will help to make replace one of them with a more secure approach.
Instead of "Encrypt/Decrypt" the passwords for the users now won't get stored in the database anylonger. Now we use a hash-algorithm which is run multiple times (to avoid "fast" brute-force-attacks) -> Phpass-library.

Next step/patch will include a better forgotten-password-handling: the current one just resets passwords on request: you just have to know the admins password and a bot requesting new passwords each hour.

I also tried to make the "remember me"-part working. Instead of IP-checks (my ip may change depending of the location of my notebook...) and encrypted userdata we now just use a sha1(passwordWithSaltHash)-hash and the identity to check against the same code stored in a field within the users db entry. If the entry is the same, user is the same and can reenter without getting asked for the user data.

What else is changed: the migration part of the Installer got some cleaner handling what migration files are needed. Instead of writing the same line multiple time, we now add one in every case the "found" version is below the checked one.
I also included a migration file for the new users-table-scheme. Hope I have done everything correct (my migration worked).

After this patch you will not be able to modify the password-generation without resetting prior passwords (they are not "decryptable" - only hashes are stored).

Included:
-------------
I. Remember-Me-function

II. Small cleanup, hardened password storage, prepared forgotten-password-handling

- application/libraries: Session.php removed (obsolete and already existing in a more current version in system/library)
- included "Phpass"-library, lib is used to generate hashes of given strings, includes salt and therefor makes a salt-db-row-entry obsolete
- Connect-library now uses the Phpass-library instead of encrypt/decrypt. Passwords of users should not be "decodeable" by admins or others: only compare hashes instead. More security for users against bad boys
- some form clean ups: when editing users, there is no need to provide a hidden join-date for "modification"
- when users register, the email may contain a password, but there is no possibility to just send that password in later requests (we only know some hashes)