kimai/kimai — pull request #378 by scolytus (2014-05-06 10:04:27+00:00)
Title: Implement new password hashing scheme.

This patch resolves #355.

# Features

The PHP built in `crypt()` function is used to encode the plaintext passwords. As the algorithm `$5$` was chosen because of compatibility reasons. This algorithm uses SHA-256 as a basis. The better `$2y$` (based on bcrypt) cannot be used since it is broken on PHP versions prior to 5.3.7 and would lead to users unable to login when the PHP version is updated.

The structure of the three new methods `encode_password()`, `verify_password()` and `password_needs_reencoding()` is similar to the new PHP Password API and the compatibility API. Once the PHP 5.3 compatibility requirement is abandoned it should be easy to switch to a newer standard API.

# TODOs / Talking points

* Currently the `crypt()` function uses 5000 rounds. That's the default and wasn't questioned.
* The `authenticate()` method is now implemented in `Abstract.php`. That's because of both `Http.php` and `Kimai.php` using it. (Btw, the`Http.php` code was/is a mess) Such methods should not exist twice. It could be placed in an intermediate class. I did not deem that necessary, though.
* The `encode_password()` function is also present in `func.php`. I'm not sure whether the Auth object is present everywhere the `encode_password()` function is needed.