From ef25d22544d4df97eae819217d841a7a3147c41d Mon Sep 17 00:00:00 2001
From: Romain d'Alverny <rdalverny@gmail.com>
Date: Wed, 12 Jan 2022 19:42:35 +0100
Subject: Use sha256 for password hashing

See moonmoon/moonmoon#10
---
 install.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'install.php')

diff --git a/install.php b/install.php
index 75166a3..5aaaef9 100755
--- a/install.php
+++ b/install.php
@@ -33,7 +33,10 @@ if ($PlanetConfig::isInstalled()) {
     OpmlManager::save(new Opml(), custom_path('people.opml'));
 
     //Save password
-    $save['password'] = file_put_contents(admin_path('inc/pwd.inc.php'), '<?php $login="admin"; $password="'.md5($_POST['password']).'"; ?>');
+    $save['password'] = file_put_contents(
+        admin_path('inc/pwd.inc.php'),
+        sprintf('<?php $login="admin"; $password="%s"; ?>', hash('sha256', $_POST['password']))
+    );
 
     if (0 != ($save['config'] + $save['password'])) {
         $status = 'installed';
-- 
cgit v1.2.1