kbhff/membersystem — pull request #20 by arnakke (2014-05-04 17:18:21+00:00)
Title: New password hashes + misc security fixes

Finally the much more secure password hashes. It is based on phPass library, which is the same used by wordpress and many others. In this use case it is basically acting as a wrapper around crypt(), but also taking care of random salt generation. I chose to use a codeigniter library that gives a little glue, a config file, and shorter syntax compared to plain phPass.
There is transitional code that migrates the md5 hashes and also takes care of upgrading the database column to fit the longer hashes. So everything should *just work* after a merge.

Also in this pull request:
One security fix that prevents not logged in users as being treated as superadmins. Most places in the code this would never actually happen as other code would block not logged in users, however, if I remember correct a few places in the codebase this could be taken advantage of.

A fix for a serious security hole that will allow anyone to change the password of almost anybody (I tried changing my own password without being logged in on the production server and it worked).