aces/Loris — pull request #867 by driusan (2014-12-15 21:57:13+00:00)
Title: Improved password hashing

This adds support for PHP 5.5+'s password hashing API to Loris. It is implemented in such a way that if it's not available, it will fall back on the old Loris authentication method.

It works by checking if the "new" hash is available in the Password_hash column, and if so using that, if not falling back on the old Password_MD5 column. If the hash is null, it will calculate the hash using the best algorithm available on the PHP install and save it to the database, deleting the old, insecure hash in the process.

If using a version of PHP that does not support the PHP password hashing API (as determined by checking for the existence of the "password_verify" function), behaviour should be identical to previously.

Once a password has been hashed using the PHP password API, the old MD5 is deleted from the database for security reasons. (This shouldn't be a problem for anyone, since once the server's been upgraded to a version of PHP that has the password api, it's unlikely to ever be downgraded to a version that doesn't.)