adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

introduce better hash function for php7+ #741

New Issue
Closed
opened 2026-10-05 00:15:05 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:15:05 +02:00
Owner
Copy link
Copy source

Hi I have briefly looked the passwordhash.class.php and find out that we are still using md5 as password hash function.
It is possible to use more advanced hash(e.g.: sha2) for php7? As I think it is a rather important issue to avoid hash collision for UAC.

http://php.net/manual/en/function.hash.php

Thanks
Ken

Hi I have briefly looked the passwordhash.class.php and find out that we are still using md5 as password hash function. It is possible to use more advanced hash(e.g.: sha2) for php7? As I think it is a rather important issue to avoid hash collision for UAC. http://php.net/manual/en/function.hash.php Thanks Ken <!-- github-sync-id:282674461 -->
adam closed this issue 2026-10-05 00:15:05 +02:00
adam commented 2026-10-05 00:15:06 +02:00
Author
Owner
Copy link
Copy source

Hello
that's not the way password works in Piwigo
that has been already discussed. Look for more
The local config already allows you to change the hashing. Look for it

Hello that's not the way password works in Piwigo that has been already discussed. Look for more The local config already allows you to change the hashing. Look for it <!-- github-comment-id:352249498 -->
adam commented 2026-10-05 00:15:07 +02:00
Author
Owner
Copy link
Copy source

I confirm what @flop25 says : Piwigo does not store password with a simple md5 hash. We use a much more complex mecanism.

An improvement could be to use the new password_hash/password_verify for PHP 5.5+ and fallback to PasswordHash for older PHP versions, but we can consider the PasswordHash class as an equivalent to password_hash/password_verify

I confirm what @flop25 says : Piwigo does not store password with a simple md5 hash. We use a much more complex mecanism. An improvement could be to use the new password_hash/password_verify for PHP 5.5+ and fallback to PasswordHash for older PHP versions, but we can consider the PasswordHash class as an equivalent to password_hash/password_verify <!-- github-comment-id:352265493 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#741