openwebwork/webwork2 — pull request #473 by goehle (2014-08-20 16:03:58+00:00)
Title: MD5 Password Hashing

Changes cryptPassword to use an MD5 type salt, which causes crypt to use MD5 hashing, allowing for longer passwords. (And MD5 is better than DES, in any case).

Things to test:
- Check out branch and check you can log in with old password.
- Set a new password (longer than 8 characters) and check that you can log in with new password, but that you need to type all of the characters.
- Set passwords using Add Student, the Classlist Manager, and the Course Admin Page and check that they all end up with MD5 hashes in the password database. (The hashes should start with $1$). Check anything else you can think of that can be used to set a password (or add a student)

This change should be pretty safe. The whole thing is backwards compatible so that passwords hashed using DES will still work correctly. (Fun fact: its forwards compatible too. Passwords set with this branch will still work even if you go back to a previous branch.) The biggest issue I can think of is that, even though I checked for this using a grep, there is something somewhere which doesn't use the cryptPassword function to set a password (WebworkSOAP maybe?). Even this is not a huge issue since it will use the older hashing scheme and will still function.