nette / security / 30134406482

93%

master: 92%

push

github

SimpleAuthenticator: added support for hashed passwords

Stored passwords may now be crypt-format hashes and can be freely
mixed with plain-text ones. Hashes are detected by the '$ident$'
prefix followed by at least 20 characters, the same way
password_verify() identifies them, so besides
bcrypt and argon2 the legacy crypt() formats work too, and a hash
with an algorithm unknown to the PHP build fails closed instead of
being compared as plain text. Plain-text comparison is timing-safe
via hash_equals().

Hashes work in the 'users' configuration section without any extra
option; argon2 hashes must be quoted in NEON because of '=' and ','.

4 of 4 new or added lines in 2 files covered. (100.0%)

558 of 601 relevant lines covered (92.85%)

0.93 hits per line