cakephp/cakephp — pull request #3599 by lorenzo (2014-05-29 21:49:41+00:00)
Title: 3.0 - Password hashers

Implements https://github.com/cakephp/cakephp/issues/2355

This adds several changes around password changes:

### Re-implemented SimplePasswordHasher

It now uses the php's built-in functions `password_check` and `password_verify`. I think there is no point anymore in using any other less secure method when this one is available. Breaking compatibility in this class is done on purpose to bring awareness of the importance of having strong password hashing.

BlowfishPasswordHasher was deprecated as it basically does the same, but it is slightly less secure and definitely not future proof.

https://github.com/ircmaxell/password_compat was added as a compatibility library for people not in PHP 5.5.

### Implemented needsRehash

Password hashers now contain a `needsRehash`, it will return true if it can detect that the password needs to be rehashed according to a new config or a new algorithm.

### Added WeakPasswordHasher

This is the old `SimplePasswordHasher`, made available for people trying to migrate to 3.0 from other versions.

### Added FallbackPasswordHasher

This allows to check a password against multiple hashers were there is only one preferred hasher. I hope this will ease the task of migrating users to a stronger password algo.