BUG! dolbiarr v20 uses md5

[JonBendtsen]

About Security page says

MAIN_SECURITY_HASH_ALGO = Undefined If unset: 'md5'

I think it should be set to some default value

[mathieupotier]

Hard to change on an already ongoing instance as it'll invalidate all login and close the instance for every one ... have to be edited carefully ...

[JonBendtsen]

Hard to change on an already ongoing instance as it'll invalidate all login and close the instance for every one ... have to be edited carefully ...

good point, very good point

[cibero42]

What if it is implemented through an env?

The env would have "Undefined" by default to prevent compatibility issues.

[mainiak]

Hello all. Maybe stupid question, but why isn't bcrypt enabled by default - especially with md5 being broken ages ago.

Is there technical reason why it can't work?

https://github.com/Dolibarr/dolibarr-docker/blob/main/docker-run.sh#L257

[eldy]

No possible to change on an already installed but we can fix this for new installation.
In this commit a64cc0a, i put the code to uncomment to have this fixed.
Need docker users to test it...