joomla/joomla-cms — pull request #5551 by nerddtvg (2014-12-29 13:00:49+00:00)
Title: Authentication: Fixing issues with legacy MD5 hashes

Authentication: Fixing issues with legacy MD5 hashes with empty salts that contain a colon (':') in the DB

I upgrade from 3.0.3 to 3.3.6 recently and found some legacy users were unable to login. These users had MD5 hashed password with empty salts. However in the DB the colon (':') was still appended to the password at the end. The hash comparison in helper.php did not take this into account and thusly denied them when trying to login.

Examples:
Plaintext: test
Salt: (empty)
DB Hash: 098f6bcd4621d373cade4e832627b4f6 (no colon)
Result: Login succeeds

Plaintext: test
Salt: (empty)
DB Hash: 098f6bcd4621d373cade4e832627b4f6: (with colon)
Result: **Login fails**

Plaintext: test
Salt: 1234
DB Hash: 16d7a4fca7442dda3ad93c9a726597e4:1234 (with colon and salt)
Result: Login succeeds

The modified code assumes that if there was a ':' found in the original has (strpos), and the salt is empty (second half of the conditional), it must have been at the end of the string. We re-add that so the hash comparison works properly.

After the change, all three of the examples listed above work indicating the original legacy users and my broken users work just fine.