joindin/joindin-api — pull request #104 by lornajane (2014-09-07 13:49:20+00:00)
Title: Store better-hashed passwords

Currently we have md5's in the password column in the user table. This is horrid because they're md5, they're not salted, and if we somehow leaked our database we'd have just leaked everyone's passwords.

Minor issue: The v1 API, used by the iphone app (and who knows what else) only accepts md5 passwords.

Solution: salt and hash the *md5* of the passwords, and store that. Not really ideal but not awful either. This patch makes the changes you need (there's an accompanying patch for the original web1 site to also respect these changes, which I'll open in a moment).

To test this patch, grab it and make sure you apply the database patches. Back up your database and either generate a new one with dbgen (you need to run the scripts/patchdb.sh first with a -i), or if you want to keep your data, you can run scripts/password-migration.php which is what we'll do for test/live. Your API should work and you should be able to log in to web2.

Note: this uses the password_hash/password_verify functionality from PHP 5.5 which we have on the live platform. If your platform doesn't have it, then please bolt https://github.com/ircmaxell/password_compat into your project to make it all work.