Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-28213

Deprecate insecure hash methods

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Documentation Review done
    • Priority: High
    • Resolution: Unresolved
    • Affects Version/s: 1.7.6, 2017.10, 1.12.0
    • Fix Version/s: 1.13.0
    • Labels:
      None

      Description

      We should deprecate insecure login hash methods. We can't remove support for these hash types until all users have updated their passwords, or users will be shut out of their accounts. New stack and legacy have different strategies here. If we could make both of them do both of the below actions, then migration would go quicker.

      • In new stack, hashes gets updated whenever users change their passwords.
      • In legacy, hashes get updated whenever users log in.

      Anyway, I don't think we can fully remove the old types until 3.x or suchlike. Deprecation, combined with log warnings and notification to customers, will have to do. We can, possibly, remove support for using them when creating new users, though I'm unsure if that is a good idea.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned
              Reporter:
              gunnstein.lye@ez.no Gunnstein Lye
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 1 day, 1 hour, 20 minutes
                  1d 1h 20m