joomla/joomla-cms — pull request #972 by andywer (2013-04-10 16:23:52+00:00)
Title: Adding a password secret to configuration.php 

Feature tracker ticket: http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_id=8549&tracker_item_id=30530

__Problem__
User passwords are salted and hashed and the password's hash and salt are stored in the users table in the database. If there is an SQL injection vulnerability then an attacker finds everything he needs to crack the hashes in the database.

__Solution__
Adding a secret, second salt that is unique for each Joomla site and that is not stored in the DB. I propose a 'pwsecret' property in the configuration.php.
There is already a 'secret' property (which is only used by the session handling and caching code), but by introducing a new property, the new code won't break existing password hashes, because it recognizes that the site was not yet set-up to use this second salt in it's hashes.
The feature cannot easily be applied to existing installations, but it will not break them and should be used for all new installations.

Regards
Andy