Password hashing #10926
Merged
Password hashing #10926
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* converts user.password to VARCHAR(255) * re-hashes existing passwords with bcrypt * re-hashes legacy password after first login * converts user.token_auth to CHAR(64) * creates/updates users with randomized token_auth * performs authentication for getTokenAuth * hides password change confirmation for modern token_auth * shows authentication token on personal settings page * adds hint about token regeneration to api page * allows users to regenerate their token_auth * allows admins to regenerate users token_auth * cleans up unused "use" statements * extracts password interaction to separate class * improves "password changes token" confirmation wording * bumps version to 3.0.0-b4 * requires confirmation before token regeneration * cleans up testing environment (passwords / tokens) * removes Password class from UsersManager model
|
@mattab the tests should work after the latest commit. I have not updated the screenshots that fail because of this change (valid changes) because I don't want to risk any merge conflicts. We can update them later. |
|
Kudos to @mneudert for this 👍 |
tsteur
added
the
not-in-changelog
# Conflicts: # CHANGELOG.md
|
🎉 important security improvement now merged in Piwik 3 🎉 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See #10740 which implements the password hashing. On top I have added a commit to use md5 for tokens and to no longer show tokens in user management
Follows up #5728