Fork of Szurubooru with patches for running on a modern system sans Docker https://git.jakob.space/szurubooru.git/atom?h=master 2020-06-06T12:58:23Z 2020-06-06T12:58:23Z Shyam Sunder 2020-06-05T22:03:37Z urn:sha1:57193b57157b7a42896c887a2d5930493ac7b290 2018-03-25T20:23:29Z ReAnzu 2018-02-25T10:44:02Z urn:sha1:2a69f0193f9e5aa451e0dbcb8c89070f3e49ffa5 * Users are only authenticated against their password on login, and to retrieve a token * Passwords are wiped from the GUI frontend and cookies after login and token retrieval * Tokens are revoked at the end of the session/logout * If the user chooses the "remember me" option, the token is stored in the cookie * Tokens correctly delete themselves on logout * Tokens can expire at user-specified date * Tokens have their last usage time * Tokens can have user defined descriptions * Users can manage login tokens in their account settings 2018-03-08T22:40:47Z ReAnzu 2018-02-25T05:45:00Z urn:sha1:3f52aceca44bc52e0c8654f46c66073320109ae9 - Changed password setup to use libsodium and argon2id (regular SHA256 hashing for passwords is inadequate as modern GPU's can hash generate billions of hashes per second). - Added code to auto migrate old passwords to the new password_hash if the existing password_hash matches either of the legacy password generation schemes (SHA1 or SHA256). - Added migration to support new password_hash format length - Added column password_revision. This field will default to 0, which all passwords will have till they're updated. After that each password hash method has a revision.