{"action":"created","issue":{"url":"https://api.github.com/repos/pkp/ojs/issues/584","labels_url":"https://api.github.com/repos/pkp/ojs/issues/584/labels{/name}","comments_url":"https://api.github.com/repos/pkp/ojs/issues/584/comments","events_url":"https://api.github.com/repos/pkp/ojs/issues/584/events","html_url":"https://github.com/pkp/ojs/pull/584","id":104000311,"number":584,"title":"Implemented improved password hashing to resolve pkp/pkp-lib#695","user":{"login":"UTSLibraryITS","id":13878841,"avatar_url":"https://avatars.githubusercontent.com/u/13878841?v=3","gravatar_id":"","url":"https://api.github.com/users/UTSLibraryITS","html_url":"https://github.com/UTSLibraryITS","followers_url":"https://api.github.com/users/UTSLibraryITS/followers","following_url":"https://api.github.com/users/UTSLibraryITS/following{/other_user}","gists_url":"https://api.github.com/users/UTSLibraryITS/gists{/gist_id}","starred_url":"https://api.github.com/users/UTSLibraryITS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/UTSLibraryITS/subscriptions","organizations_url":"https://api.github.com/users/UTSLibraryITS/orgs","repos_url":"https://api.github.com/users/UTSLibraryITS/repos","events_url":"https://api.github.com/users/UTSLibraryITS/events{/privacy}","received_events_url":"https://api.github.com/users/UTSLibraryITS/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-08-31T07:17:05Z","updated_at":"2015-09-16T19:25:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pkp/ojs/pulls/584","html_url":"https://github.com/pkp/ojs/pull/584","diff_url":"https://github.com/pkp/ojs/pull/584.diff","patch_url":"https://github.com/pkp/ojs/pull/584.patch"},"body":"fixes pkp/pkp-lib#695\r\n\r\nWe have implemented [password_compat](https://github.com/ircmaxell/password_compat) library for improved OJS password hashing.\r\n\r\nAlthough PHP 5.3 is required for password_compat, all changes are fully backwards compatible. If the version of PHP is supported, the more secure bcrypt encryption will automatically be used.\r\n\r\nPassword reset hashes have also been improved with better hashing (and HMAC where available) and the addition of a unique salt (configurable via the config file). Reset hashes also have a basic expiration component, based off the user's last login time.\r\n\r\nAll existing \\ legacy password hashes will continue to work. They will be seamlessly updated to new bcrypt-based hashes the next time the user logs in.\r\n\r\nPlease let us know if there is any issues or comments."},"comment":{"url":"https://api.github.com/repos/pkp/ojs/issues/comments/140858170","html_url":"https://github.com/pkp/ojs/pull/584#issuecomment-140858170","issue_url":"https://api.github.com/repos/pkp/ojs/issues/584","id":140858170,"user":{"login":"ctgraham","id":7001322,"avatar_url":"https://avatars.githubusercontent.com/u/7001322?v=3","gravatar_id":"","url":"https://api.github.com/users/ctgraham","html_url":"https://github.com/ctgraham","followers_url":"https://api.github.com/users/ctgraham/followers","following_url":"https://api.github.com/users/ctgraham/following{/other_user}","gists_url":"https://api.github.com/users/ctgraham/gists{/gist_id}","starred_url":"https://api.github.com/users/ctgraham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ctgraham/subscriptions","organizations_url":"https://api.github.com/users/ctgraham/orgs","repos_url":"https://api.github.com/users/ctgraham/repos","events_url":"https://api.github.com/users/ctgraham/events{/privacy}","received_events_url":"https://api.github.com/users/ctgraham/received_events","type":"User","site_admin":false},"created_at":"2015-09-16T19:25:20Z","updated_at":"2015-09-16T19:25:20Z","body":"+1 to removing the encryption config.inc.php setting from master, and thanks @samueloph for illustrating the multiline select in Github links.  Didn't know about that!"}}