#1016 Deprecate MD5, SHA1, SHA512: no longer allowed for active use

- Deprecate unsalted hashes: if such a hash is configured, move it to the legacy hashes setting to still support the existing hashes in the database but hash all passwords from now on with our default, SHA256.
2017-10-19 21:30:19 +02:00
parent 7d445217d6
commit fca77b940f
14 changed files with 121 additions and 87 deletions
@@ -191,7 +191,10 @@ settings:
        # PLAINTEXT ( unhashed password),
        # MYBB, IPB3, PHPFUSION, SMF, XENFORO, SALTED2MD5, JOOMLA, BCRYPT, WBB3, SHA512,
        # DOUBLEMD5, PBKDF2, PBKDF2DJANGO, WORDPRESS, ROYALAUTH, CUSTOM(for developpers only)
-        passwordHash: SHA256
+        passwordHash: SHA512
+        legacyHashes:
+        - PBKDF2
+        - WORDPRESS
        # salt length for the SALTED2MD5 MD5(MD5(password)+salt)
        doubleMD5SaltLength: 8
        # If password checking return false , do we need to check with all