joomla/joomla-cms — pull request #2656 by dongilbert (2013-12-10 03:54:13+00:00)
Title: Use crypt-sha256 for password hashes.

First of all, thank you to all involved in the discussions on pull requset #2555, everyone's input was very valueable and needed to help push this decision to help keep our users websites secure. Thank you very much to @hackwar for sticking with it through thick and thin, and getting a working implementation that I could now make that much more secure via this PR.

From @ircmaxell's comments on #2555 (and on Twitter today), it was decided that something more could be done that would be much more secure, and would still retain backward-compatibility with PHP versions < 5.3.7. I did a bit of research following Anthony's suggestions, and came up with the code here.

As you can see, not much has changed. What this PR does is help move all passwords up to an algorithm that is much more secure than salted-md5 in a backwards compatible way. It should be entirely transparent to our users.

What we need now, in order to get this out for a timely release before the holidays, is LOTS of testing. If you are able to run multiple PHP environments, please test in all of them available.

In order to test, create a fresh Joomla installation. Then, apply this patch and log out. Once your logged out, check your database `#__users` table, you should see your 3.2 password in there prefixed with `$2y$`. Then log back into the site (you should have no issues logging in, if you do, the test failed, and leave a -1 with details about your PHP environment). The entry in the database table should be changed, and it will now be prefixed with `$5$` which indicates that you password is now hashed using `crypt-sha256`. If you got this far, and don't have access to any other PHP environments to do extended testing in, I want to personally say thanks for taking the time, it is appreciated. Please leave a comment with a +1 that contains the PHP version you tested.

If you do have other environments available, can you do some extended testing? Awesome. The extended testing would consist of moving your Joomla installation to a new PHP environment, and making sure you are able to log in there as well without issue. One of the major issues that we encountered with implementing the BCrypt feature in 3.2 was when we went from a PHP version greater than 5.3.6 to something below. It would be _great_ if you could test that scenario and leave a comment detailing what environments you were able to test in.

If you do run into any issues while testing, including not being able to log in, or your password not being re-hashed to be prefixed with `$5$`, please leave a comment below with a -1, and detail the environment you were in that failed.

Thanks all!