search

alextselegidis / easyappointments

:date: Easy!Appointments - Self Hosted Appointment Scheduler
https://easyappointments.org
GNU General Public License v3.0
3.34k stars 1.27k forks source link

Use PHP integrated PHP algorithms for hashing user passwords. #439

Closed simmonspaul closed 4 years ago

simmonspaul commented 6 years ago

The use of both a hashed password and salt has been depreciated in favor of using stronger self-salting algorithms.

see php password_hash https://secure.php.net/manual/en/function.password-hash.php

Remediating this will assist other applications that need to integrate user credentials.

Many thanks

alextselegidis commented 6 years ago

Hi @simmonspaul, you are right this is a good thing to do, I will change this for v1.4

  Alex Tselegidis, Easy!Appointments Creator
  Need a customization? Contact me in person!

simmonspaul commented 6 years ago

This should help https://github.com/benedmunds/CodeIgniter-Ion-Auth I'm going to be doing some playing around with it.

alextselegidis commented 6 years ago

Hi @simmonspaul, thanks for your message.

Feel free to make a pull request if you reach a fully functional state.

Greetings!

  Alex Tselegidis, Easy!Appointments Creator
  Need a customization? Contact me in person!

alextselegidis commented 4 years ago

Quick update on this ticket.

In order to update the passwords, every time the user logs in we will need to write the updated hashed password string to the database and ditch the salt value as it is not needed anymore.

Since in the following Easy!Appointments releases there might be an upgrade to another framework that handles this differently, I will skip performing this actions for v1.4.0 and perform them once when the right time comes.

Thanks for posting this nevertheless!

  Alex Tselegidis, Easy!Appointments Creator
  Need a customization? Contact me in person!