Feature #7410: Add salt to user passwords - Redmine

Actions

Feature #7410

closed

Status:

Closed

Priority:

Normal

Assignee:

Category:

Accounts / authentication

Target version:

Start date:

2011-01-22

Due date:

% Done:

Estimated time:

Resolution:

Fixed

Description

User passwords are stored as SHA1(password) which makes them vulnerable to a dictionary attack from an attacker who gets access to the database.

The change consists of generating a salt for each user and storing SHA1(salt+SHA1(password)) in the database.

Related issues

Actions

Also available in: Atom PDF