As you know, the passwords are stored in the database as plain text by default.

Now, I've just recently finished developing a site and only just found this out, I've asked the client whether this will be a problem or not and I just know that the answer is going to be yes... So I've been trying to find information on how to go about this and found a few leads* but they all seem to go cold.

Could someone please save me the time and effort and outline how I go about hashing the passwords in the umbracoUser table. Thanks.

I should mention that I don't care for members, I only care about users.

The best I could come up with is adding this to my web.config:

<membership defaultProvider="UmbracoMembershipProvider" userIsOnlineTimeWindow="15">
<providers>
<clear/>
<add name="UmbracoMembershipProvider"
type="umbraco.providers.UsersMembershipProvider"
passwordFormat="Hashed"
enablePasswordRetrieval="false"
enablePasswordReset="false"
requiresQuestionAndAnswer="false"/>
</providers>
</membership>

but it obviously doesn't do the trick.

Thanks in advance for your help!

Ps. I'm using v3.0.5


* http://www.codeplex.com/umbraco/WorkItem/View.aspx?WorkItemId=15264
http://www.codeplex.com/umbraco/WorkItem/View.aspx?WorkItemId=6386
plus other pages...

And you can always use other membership providers that do encrypt or hash the password.

---

Ruben Verborgh | Umbraco Core Team Developer | Working on: Data layer table utility. | LinkedIn

Yes, you would need v4.
If you need this in 3.0.5 you'll need to get the source code and modify.

Thinking about it ... the code relies on a table "umbracoUser". Would it be possible to rename the table, then write a view called "umbracoUser", in which you could have a function to unencode the clear text password?



The internal "User.validateCredentials()" call would still work but now it selects off the view.




Problem is you need to update all the dependencies that relied on the original "umbracoUser" table.
Updating/inserting users is an obvious issue ....

---

___________________________________________________________________________________

Neil