From caaf741691c9d44a9a186d6ce924fecb04f4f347 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Fri, 22 Apr 2016 05:35:43 +0200
Subject: [SECURITY] keep up with modern password hashing standards

---
 inc/config.php | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index d5bdbfe5..c0e967af 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1672,3 +1672,18 @@
 		'<a href="https://youtu.be/$2" target="_blank" class="file">'.
 		'<img style="width:360px;height:270px;" src="//img.youtube.com/vi/$2/0.jpg" class="post-image"/>'.
 		'</a></div>';
+
+	// Password hashing function
+	//
+	// $5$ <- SHA256
+	// $6$ <- SHA512
+	//
+	// 25000 rounds make for ~0.05s on my 2015 Core i3 computer.
+	//
+	// https://secure.php.net/manual/en/function.crypt.php
+	$config['password_crypt'] = '$6$rounds=25000$';
+
+	// Password hashing method version
+	// If set to 0, it won't upgrade hashes using old password encryption schema, only create new.
+	// You can set it to a higher value, to further migrate to other password hashing function.
+	$config['password_crypt_version'] = 1;
-- 
cgit v1.3