UBB.threads PHP Forum Software Community Forums UBB.threads Version 7/8 Support UBB.threads 8.1 — password_hash() / rehash-on-login planned?

Hi all,

We're running UBB.threads 8.0.1 on PHP 8.4. Looking at the stock code, member passwords are stored as md5() (and older DES crypt() hashes are still accepted at login).

Two questions for the developers:

1. Does the upcoming 8.1.0 release move password storage to PHP's password_hash() / password_verify()?
2. If so, will existing md5/crypt hashes be upgraded automatically when a member logs in (password_needs_rehash), so nobody is forced to reset?

If this is already on the roadmap, a rough idea of the 8.1.0 timing would help us plan. Happy to test a beta if that's useful.

Thanks!

No, we currently have no plans on updating the built in MD5 lines to process passwords with password_hash and password_verify. Keeping assets updated for PHP compatibility has been our main goal with current rounds of updates.

If we do update the mechanism in the future users would have to request a new password before being able to login with the forgot password system as you cannot decode an MD5 hash to update it to another hashing scheme.