{"action":"created","comment":{"url":"https://api.github.com/repos/opnsense/core/pulls/comments/89742029","pull_request_review_id":10277737,"id":89742029,"diff_hunk":"@@ -40,7 +40,7 @@\n     do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);\n \n     if ($_POST['passwordfld1'] != $_POST['passwordfld2'] ||\n-        $config['system']['user'][$userindex[$username]]['password'] != crypt($_POST['passwordfld0'], '$6$')) {\n+        !password_verify($_POST['passwordfld0'], $config['system']['user'][$userindex[$username]]['password'])) {","path":"src/www/system_usermanager_passwordmg.php","position":5,"original_position":5,"commit_id":"31901b2d1e7042ad8a066e5979851b5c9b0f9025","original_commit_id":"31901b2d1e7042ad8a066e5979851b5c9b0f9025","user":{"login":"pioorg","id":23506256,"avatar_url":"https://avatars.githubusercontent.com/u/23506256?v=3","gravatar_id":"","url":"https://api.github.com/users/pioorg","html_url":"https://github.com/pioorg","followers_url":"https://api.github.com/users/pioorg/followers","following_url":"https://api.github.com/users/pioorg/following{/other_user}","gists_url":"https://api.github.com/users/pioorg/gists{/gist_id}","starred_url":"https://api.github.com/users/pioorg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pioorg/subscriptions","organizations_url":"https://api.github.com/users/pioorg/orgs","repos_url":"https://api.github.com/users/pioorg/repos","events_url":"https://api.github.com/users/pioorg/events{/privacy}","received_events_url":"https://api.github.com/users/pioorg/received_events","type":"User","site_admin":false},"body":"Yes, it does.","created_at":"2016-11-28T09:23:13Z","updated_at":"2016-11-28T09:23:13Z","html_url":"https://github.com/opnsense/core/pull/1282#discussion_r89742029","pull_request_url":"https://api.github.com/repos/opnsense/core/pulls/1282","_links":{"self":{"href":"https://api.github.com/repos/opnsense/core/pulls/comments/89742029"},"html":{"href":"https://github.com/opnsense/core/pull/1282#discussion_r89742029"},"pull_request":{"href":"https://api.github.com/repos/opnsense/core/pulls/1282"}}},"pull_request":{"url":"https://api.github.com/repos/opnsense/core/pulls/1282","id":95457498,"html_url":"https://github.com/opnsense/core/pull/1282","diff_url":"https://github.com/opnsense/core/pull/1282.diff","patch_url":"https://github.com/opnsense/core/pull/1282.patch","issue_url":"https://api.github.com/repos/opnsense/core/issues/1282","number":1282,"state":"open","locked":false,"title":"Improved password hashes.","user":{"login":"pioorg","id":23506256,"avatar_url":"https://avatars.githubusercontent.com/u/23506256?v=3","gravatar_id":"","url":"https://api.github.com/users/pioorg","html_url":"https://github.com/pioorg","followers_url":"https://api.github.com/users/pioorg/followers","following_url":"https://api.github.com/users/pioorg/following{/other_user}","gists_url":"https://api.github.com/users/pioorg/gists{/gist_id}","starred_url":"https://api.github.com/users/pioorg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pioorg/subscriptions","organizations_url":"https://api.github.com/users/pioorg/orgs","repos_url":"https://api.github.com/users/pioorg/repos","events_url":"https://api.github.com/users/pioorg/events{/privacy}","received_events_url":"https://api.github.com/users/pioorg/received_events","type":"User","site_admin":false},"body":"Replaced crypt($password, '$6$') with password_hash and password_verify in order to produce salted hashes from passwords.\r\n\r\ncrypt($password, '$6$') doesn't create any randomness in password hash, because the second parameter should contain a random salt (and optionally a number of rounds). With only '$6$' neither is provided. Switching from SHA512 to bcrypt seems to be justified be the speed of possible password cracking.","created_at":"2016-11-28T08:46:55Z","updated_at":"2016-11-28T09:23:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"7261c0de8425e11fadda7f414cc819aca1b70671","assignee":{"login":"fichtner","id":1915288,"avatar_url":"https://avatars.githubusercontent.com/u/1915288?v=3","gravatar_id":"","url":"https://api.github.com/users/fichtner","html_url":"https://github.com/fichtner","followers_url":"https://api.github.com/users/fichtner/followers","following_url":"https://api.github.com/users/fichtner/following{/other_user}","gists_url":"https://api.github.com/users/fichtner/gists{/gist_id}","starred_url":"https://api.github.com/users/fichtner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fichtner/subscriptions","organizations_url":"https://api.github.com/users/fichtner/orgs","repos_url":"https://api.github.com/users/fichtner/repos","events_url":"https://api.github.com/users/fichtner/events{/privacy}","received_events_url":"https://api.github.com/users/fichtner/received_events","type":"User","site_admin":false},"assignees":[{"login":"fichtner","id":1915288,"avatar_url":"https://avatars.githubusercontent.com/u/1915288?v=3","gravatar_id":"","url":"https://api.github.com/users/fichtner","html_url":"https://github.com/fichtner","followers_url":"https://api.github.com/users/fichtner/followers","following_url":"https://api.github.com/users/fichtner/following{/other_user}","gists_url":"https://api.github.com/users/fichtner/gists{/gist_id}","starred_url":"https://api.github.com/users/fichtner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fichtner/subscriptions","organizations_url":"https://api.github.com/users/fichtner/orgs","repos_url":"https://api.github.com/users/fichtner/repos","events_url":"https://api.github.com/users/fichtner/events{/privacy}","received_events_url":"https://api.github.com/users/fichtner/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/opnsense/core/pulls/1282/commits","review_comments_url":"https://api.github.com/repos/opnsense/core/pulls/1282/comments","review_comment_url":"https://api.github.com/repos/opnsense/core/pulls/comments{/number}","comments_url":"https://api.github.com/repos/opnsense/core/issues/1282/comments","statuses_url":"https://api.github.com/repos/opnsense/core/statuses/31901b2d1e7042ad8a066e5979851b5c9b0f9025","head":{"label":"pioorg:password_upgrade","ref":"password_upgrade","sha":"31901b2d1e7042ad8a066e5979851b5c9b0f9025","user":{"login":"pioorg","id":23506256,"avatar_url":"https://avatars.githubusercontent.com/u/23506256?v=3","gravatar_id":"","url":"https://api.github.com/users/pioorg","html_url":"https://github.com/pioorg","followers_url":"https://api.github.com/users/pioorg/followers","following_url":"https://api.github.com/users/pioorg/following{/other_user}","gists_url":"https://api.github.com/users/pioorg/gists{/gist_id}","starred_url":"https://api.github.com/users/pioorg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pioorg/subscriptions","organizations_url":"https://api.github.com/users/pioorg/orgs","repos_url":"https://api.github.com/users/pioorg/repos","events_url":"https://api.github.com/users/pioorg/events{/privacy}","received_events_url":"https://api.github.com/users/pioorg/received_events","type":"User","site_admin":false},"repo":{"id":74745467,"name":"core","full_name":"pioorg/core","owner":{"login":"pioorg","id":23506256,"avatar_url":"https://avatars.githubusercontent.com/u/23506256?v=3","gravatar_id":"","url":"https://api.github.com/users/pioorg","html_url":"https://github.com/pioorg","followers_url":"https://api.github.com/users/pioorg/followers","following_url":"https://api.github.com/users/pioorg/following{/other_user}","gists_url":"https://api.github.com/users/pioorg/gists{/gist_id}","starred_url":"https://api.github.com/users/pioorg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pioorg/subscriptions","organizations_url":"https://api.github.com/users/pioorg/orgs","repos_url":"https://api.github.com/users/pioorg/repos","events_url":"https://api.github.com/users/pioorg/events{/privacy}","received_events_url":"https://api.github.com/users/pioorg/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pioorg/core","description":"OPNsense GUI, API and systems backend","fork":true,"url":"https://api.github.com/repos/pioorg/core","forks_url":"https://api.github.com/repos/pioorg/core/forks","keys_url":"https://api.github.com/repos/pioorg/core/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pioorg/core/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pioorg/core/teams","hooks_url":"https://api.github.com/repos/pioorg/core/hooks","issue_events_url":"https://api.github.com/repos/pioorg/core/issues/events{/number}","events_url":"https://api.github.com/repos/pioorg/core/events","assignees_url":"https://api.github.com/repos/pioorg/core/assignees{/user}","branches_url":"https://api.github.com/repos/pioorg/core/branches{/branch}","tags_url":"https://api.github.com/repos/pioorg/core/tags","blobs_url":"https://api.github.com/repos/pioorg/core/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pioorg/core/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pioorg/core/git/refs{/sha}","trees_url":"https://api.github.com/repos/pioorg/core/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pioorg/core/statuses/{sha}","languages_url":"https://api.github.com/repos/pioorg/core/languages","stargazers_url":"https://api.github.com/repos/pioorg/core/stargazers","contributors_url":"https://api.github.com/repos/pioorg/core/contributors","subscribers_url":"https://api.github.com/repos/pioorg/core/subscribers","subscription_url":"https://api.github.com/repos/pioorg/core/subscription","commits_url":"https://api.github.com/repos/pioorg/core/commits{/sha}","git_commits_url":"https://api.github.com/repos/pioorg/core/git/commits{/sha}","comments_url":"https://api.github.com/repos/pioorg/core/comments{/number}","issue_comment_url":"https://api.github.com/repos/pioorg/core/issues/comments{/number}","contents_url":"https://api.github.com/repos/pioorg/core/contents/{+path}","compare_url":"https://api.github.com/repos/pioorg/core/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pioorg/core/merges","archive_url":"https://api.github.com/repos/pioorg/core/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pioorg/core/downloads","issues_url":"https://api.github.com/repos/pioorg/core/issues{/number}","pulls_url":"https://api.github.com/repos/pioorg/core/pulls{/number}","milestones_url":"https://api.github.com/repos/pioorg/core/milestones{/number}","notifications_url":"https://api.github.com/repos/pioorg/core/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pioorg/core/labels{/name}","releases_url":"https://api.github.com/repos/pioorg/core/releases{/id}","deployments_url":"https://api.github.com/repos/pioorg/core/deployments","created_at":"2016-11-25T09:44:19Z","updated_at":"2016-11-25T09:44:23Z","pushed_at":"2016-11-28T08:40:43Z","git_url":"git://github.com/pioorg/core.git","ssh_url":"git@github.com:pioorg/core.git","clone_url":"https://github.com/pioorg/core.git","svn_url":"https://github.com/pioorg/core","homepage":"https://opnsense.org/","size":52989,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"opnsense:master","ref":"master","sha":"68739fbbb70423cb59b1b2f0f4df6c30a4f3da06","user":{"login":"opnsense","id":9979117,"avatar_url":"https://avatars.githubusercontent.com/u/9979117?v=3","gravatar_id":"","url":"https://api.github.com/users/opnsense","html_url":"https://github.com/opnsense","followers_url":"https://api.github.com/users/opnsense/followers","following_url":"https://api.github.com/users/opnsense/following{/other_user}","gists_url":"https://api.github.com/users/opnsense/gists{/gist_id}","starred_url":"https://api.github.com/users/opnsense/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/opnsense/subscriptions","organizations_url":"https://api.github.com/users/opnsense/orgs","repos_url":"https://api.github.com/users/opnsense/repos","events_url":"https://api.github.com/users/opnsense/events{/privacy}","received_events_url":"https://api.github.com/users/opnsense/received_events","type":"Organization","site_admin":false},"repo":{"id":27965134,"name":"core","full_name":"opnsense/core","owner":{"login":"opnsense","id":9979117,"avatar_url":"https://avatars.githubusercontent.com/u/9979117?v=3","gravatar_id":"","url":"https://api.github.com/users/opnsense","html_url":"https://github.com/opnsense","followers_url":"https://api.github.com/users/opnsense/followers","following_url":"https://api.github.com/users/opnsense/following{/other_user}","gists_url":"https://api.github.com/users/opnsense/gists{/gist_id}","starred_url":"https://api.github.com/users/opnsense/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/opnsense/subscriptions","organizations_url":"https://api.github.com/users/opnsense/orgs","repos_url":"https://api.github.com/users/opnsense/repos","events_url":"https://api.github.com/users/opnsense/events{/privacy}","received_events_url":"https://api.github.com/users/opnsense/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/opnsense/core","description":"OPNsense GUI, API and systems backend","fork":false,"url":"https://api.github.com/repos/opnsense/core","forks_url":"https://api.github.com/repos/opnsense/core/forks","keys_url":"https://api.github.com/repos/opnsense/core/keys{/key_id}","collaborators_url":"https://api.github.com/repos/opnsense/core/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/opnsense/core/teams","hooks_url":"https://api.github.com/repos/opnsense/core/hooks","issue_events_url":"https://api.github.com/repos/opnsense/core/issues/events{/number}","events_url":"https://api.github.com/repos/opnsense/core/events","assignees_url":"https://api.github.com/repos/opnsense/core/assignees{/user}","branches_url":"https://api.github.com/repos/opnsense/core/branches{/branch}","tags_url":"https://api.github.com/repos/opnsense/core/tags","blobs_url":"https://api.github.com/repos/opnsense/core/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/opnsense/core/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/opnsense/core/git/refs{/sha}","trees_url":"https://api.github.com/repos/opnsense/core/git/trees{/sha}","statuses_url":"https://api.github.com/repos/opnsense/core/statuses/{sha}","languages_url":"https://api.github.com/repos/opnsense/core/languages","stargazers_url":"https://api.github.com/repos/opnsense/core/stargazers","contributors_url":"https://api.github.com/repos/opnsense/core/contributors","subscribers_url":"https://api.github.com/repos/opnsense/core/subscribers","subscription_url":"https://api.github.com/repos/opnsense/core/subscription","commits_url":"https://api.github.com/repos/opnsense/core/commits{/sha}","git_commits_url":"https://api.github.com/repos/opnsense/core/git/commits{/sha}","comments_url":"https://api.github.com/repos/opnsense/core/comments{/number}","issue_comment_url":"https://api.github.com/repos/opnsense/core/issues/comments{/number}","contents_url":"https://api.github.com/repos/opnsense/core/contents/{+path}","compare_url":"https://api.github.com/repos/opnsense/core/compare/{base}...{head}","merges_url":"https://api.github.com/repos/opnsense/core/merges","archive_url":"https://api.github.com/repos/opnsense/core/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/opnsense/core/downloads","issues_url":"https://api.github.com/repos/opnsense/core/issues{/number}","pulls_url":"https://api.github.com/repos/opnsense/core/pulls{/number}","milestones_url":"https://api.github.com/repos/opnsense/core/milestones{/number}","notifications_url":"https://api.github.com/repos/opnsense/core/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/opnsense/core/labels{/name}","releases_url":"https://api.github.com/repos/opnsense/core/releases{/id}","deployments_url":"https://api.github.com/repos/opnsense/core/deployments","created_at":"2014-12-13T15:43:50Z","updated_at":"2016-11-28T07:46:32Z","pushed_at":"2016-11-28T08:46:55Z","git_url":"git://github.com/opnsense/core.git","ssh_url":"git@github.com:opnsense/core.git","clone_url":"https://github.com/opnsense/core.git","svn_url":"https://github.com/opnsense/core","homepage":"https://opnsense.org/","size":57375,"stargazers_count":307,"watchers_count":307,"language":"PHP","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":97,"mirror_url":null,"open_issues_count":109,"forks":97,"open_issues":109,"watchers":307,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/opnsense/core/pulls/1282"},"html":{"href":"https://github.com/opnsense/core/pull/1282"},"issue":{"href":"https://api.github.com/repos/opnsense/core/issues/1282"},"comments":{"href":"https://api.github.com/repos/opnsense/core/issues/1282/comments"},"review_comments":{"href":"https://api.github.com/repos/opnsense/core/pulls/1282/comments"},"review_comment":{"href":"https://api.github.com/repos/opnsense/core/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/opnsense/core/pulls/1282/commits"},"statuses":{"href":"https://api.github.com/repos/opnsense/core/statuses/31901b2d1e7042ad8a066e5979851b5c9b0f9025"}}}}
{"actor":{"display_login":"pioorg"}}