diff options
| author | Dries Buytaert <dries@buytaert.net> | 2008-03-31 20:50:05 +0000 |
|---|---|---|
| committer | Dries Buytaert <dries@buytaert.net> | 2008-03-31 20:50:05 +0000 |
| commit | ed59911f9ee542da87ae7cddcb2d50da0e785079 (patch) | |
| tree | 8b7f873dd371ae19d1f678e26ad548c47ff1b0ad /CHANGELOG.txt | |
| parent | 763298455f88e26f286749b5f7ff6c9471742012 (diff) | |
| download | brdo-ed59911f9ee542da87ae7cddcb2d50da0e785079.tar.gz brdo-ed59911f9ee542da87ae7cddcb2d50da0e785079.tar.bz2 | |
- Patch #29706 by pwolanin, solardiz, et al: more secure password hashing.
This is a big and important patch for Drupal's security. We are switching
to much stronger password hashes that are also compatible with the Portable
PHP password hashing framework.
The new password hashes defeat a number of attacks, including:
- The ability to try candidate passwords against multiple hashes at once.
- The ability to use pre-hashed lists of candidate passwords.
- The ability to determine whether two users have the same (or different)
password without actually having to guess one of the passwords.
Also implemented a pluggable password hashing API (similar to how an alternate
cache mechanism can be used) to allow developers to readily substitute an
alternative hashing and authentication scheme.
Thanks all!
Diffstat (limited to 'CHANGELOG.txt')
| -rw-r--r-- | CHANGELOG.txt | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/CHANGELOG.txt b/CHANGELOG.txt index 102892f41..194c08682 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -4,6 +4,11 @@ Drupal 7.0, xxxx-xx-xx (development version) ---------------------- - Security: * Protected cron.php -- cron will only run if the proper key is provided. + * Changed to much stronger password hashes that are also compatible with the + Portable PHP password hashing framework. + * Implemented a pluggable password hashing API (similar to how an alternate + cache mechanism can be used) to allow developers to readily substitute + an alternative hashing and authentication scheme. - Usability: * Implemented drag-and-drop positioning for input format listings. * Provide descriptions for permissions on the administration page. |