Hello,
this is my first post, so dont be very angry if I’ll make some stupid mistakes 
I recentry installer user extension (+rights, but thats not the topic), and everything looked great, except security - password is only hashed using md5 or sha1, by default. I wanted salts for every user password.
So thats what I did: (maybe this will be helpful for someone)
-
I created additional column in table "tbl_users", called "salt".
-
edited my config.php like this:
'params'=>array(
...
'hash_salt_length' => '7',
'hash_site_key' => 'dlfkgknbcvjkbsdkjflsdkhfdf34534jkHL$@#K$^kb',
...
- edited UserModule.php file:
public static function encrypting($string="",$salt="") {
$sl = Yii::app()->getParams()->hash_salt_length;
$site_key = Yii::app()->getParams()->hash_site_key;
//hashing plain password with added salt
return hash_hmac('sha256', $string . $salt, $site_key);
/*
$hash = Yii::app()->getModule('user')->hash;
if ($hash=="md5")
return md5($string);
if ($hash=="sha1")
return sha1($string);
else
return hash($hash,$string);
*
*/
}
/**
* Generates random string, length from config - hash_salt_length
* @return <String>
*/
public static function randomKey(){
$salt = "";
$index = 0;
$sl = Yii::app()->getParams()->hash_salt_length;
$letters = array('A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','R','S','T','U','V','Z','0','1','2','3','4','5','6','7','8','9');
for($i=0;$i<$sl;$i++){
$index = mt_rand(0, count($letters)-1);
$salt.= ($index % 2)==0 ? $letters[$index] : strtolower($letters[$index]);
}
return $salt;
}
- Searched with my IDE (i like netbeans ) for string “encrypting(”, and changed every line, which had not activation key, but password:
that means, files:
AdminController.php, (Around 80 line and 116 line):
$model->salt=UserModule::randomKey();
$model->password=Yii::app()->controller->module->encrypting($model->password, $model->salt);
ProfileController.php (~78 line):
$new_password->salt = UserModule::randomKey();
$new_password->password = UserModule::encrypting($model->password, $salt);
RecoveryController.php (~24 line):
$find->salt = UserModule::randomKey();
$find->password = Yii::app()->controller->module->encrypting($form2->password, $find->salt);
RegistrationController.php (~58 line):
$model->salt = UserModule::randomKey();
$model->password=UserModule::encrypting($model->password,$model->salt);
$model->verifyPassword=UserModule::encrypting($model->verifyPassword, $model->salt);
UserIdentity.php (~35 line):
else if(Yii::app()->getModule('user')->encrypting($this->password, $user->salt)!==$user->password)
- Edit models/User.php "scopes" and "defaultScopes" functions, to add "salt" to selective columns.
I haven’t tested every function yet (such as recovery), but at least i can login
And by the way, dont forget to edit users in database. To get what info should be used, put for example to RegistrationController such lines:
echo "salt: ".$salt;
echo "<br />";
echo Yii::app()->controller->module->encrypting("admin",$salt);
Waiting for better solutions