#1016 Deprecate MD5, SHA1, SHA512: no longer allowed for active use

- Deprecate unsalted hashes: if such a hash is configured, move it to the legacy hashes setting to still support the existing hashes in the database but hash all passwords from now on with our default, SHA256.
2017-10-19 21:30:19 +02:00
parent 7d445217d6
commit fca77b940f
14 changed files with 121 additions and 87 deletions
@@ -53,7 +53,7 @@ public final class SecuritySettings implements SettingsHolder {
        newProperty("settings.security.passwordMaxLength", 30);

    @Comment({
-        "Possible values: SHA256, BCRYPT, BCRYPT2Y, PBKDF2, SALTEDSHA512, WHIRLPOOL,",
+        "Possible values: SHA256, BCRYPT, BCRYPT2Y, PBKDF2, SALTEDSHA512,",
        "MYBB, IPB3, PHPBB, PHPFUSION, SMF, XENFORO, XAUTH, JOOMLA, WBB3, WBB4, MD5VB,",
        "PBKDF2DJANGO, WORDPRESS, ROYALAUTH, CUSTOM (for developers only). See full list at",
        "https://github.com/AuthMe/AuthMeReloaded/blob/master/docs/hash_algorithms.md"