Problem/Motivation

Spin off from #3352094: Notify users that they need to reset their password when it matches an unsupported hash type which is itself a spin-off from #1845004: Replace custom password hashing library with PHP password_hash().

Eventually, we will move core's custom phpass password hashing logic out of core.

Some sites will then have users that haven't logged in for months or years, who need to reset their passwords.

It would be feasible to detect the old phpass hash, and give those users an additional hint that they should definitely reset their passwords. However, this potentially allows enumeration that there are old hashes in the database, so we might also not want to do that.

Postponed on #3352094: Notify users that they need to reset their password when it matches an unsupported hash type because we should definitely do the admin-facing message first.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Comments

catch created an issue. See original summary.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.