SimpleMachines/SMF2.1 — pull request #1674 by Dragooon (2014-05-26 12:01:25+00:00)
Title: Update hashing algorithm for passwords to SHA256

Previously hashes were computed as sha1(lower(username) . password), update this to add a layer of sha256 so that it becomes sha256(sha1(lower(username) . password) based on ideas by @jdarwood007.

The cookie password hash becomes sha256(password_hash . salt) instead of sha1(password_hash . salt), but the login hash remains same as before. This provides additional protection as someone with the hash from the database can't login directly simply by submitting that into the login form, they'd still need the original password to be able to login

Signed-off-by: Shitiz Garg