Merge pull request #754 from bertptrs/master

Use a more secure password hash

Author: SSilence

controllers/Index.php

@@ -101,7 +101,7 @@ public function password() {
         $this->view = new \helpers\View();
         $this->view->password = true;
         if(isset($_POST['password']))
-            $this->view->hash = hash("sha512", \F3::get('salt') . $_POST['password']);
+            $this->view->hash = password_hash($_POST['password'], PASSWORD_DEFAULT);
         echo $this->view->render('templates/login.phtml');
     }
 

defaults.ini

@@ -15,7 +15,6 @@ items_lifetime=30
 base_url=
 username=
 password=
-salt=lkjl1289
 public=
 html_title=selfoss
 rss_title=selfoss feed

helpers/Authentication.php

@@ -98,7 +98,7 @@ public function loginWithoutUser() {
     public function login($username, $password) {
         if($this->enabled()) {
             if(
-                $username == \F3::get('username') &&  hash("sha512", \F3::get('salt') . $password) == \F3::get('password')
+                $username == \F3::get('username') && password_verify($password, \F3::get('password'))
             ) {
                 $this->loggedin = true;
                 $_SESSION['loggedin'] = true;