Updating from Prestashop 1.6 MD5 encryption to 1.7 - encryption

Question

I am updating my PS 1.6 to 1.7. I know PS 1.6 uses this encryption method md5(_COOKIE_KEY_.$passwd) but we converted it to md5($passwd) previously for having compatibility with our previous shop not-prestashop.
Now we want to update to 1.7 and we see that the encryption method has changed to hash(). We have achieved to log in previous users changing this function: getByEmail(), but now we want the register to work well (saving the password as md5($plaintextpassword)). We know that the new encryption method is much more secure and is not recommended to use md5($plaintextpassword) but now we cannot change that.
We have changed in Classes/Customer.php all lines from:
$this->passwd = $crypto->hash($password);
to:
$this->passwd = md5($password);
But with all this changes when we register a new user, it's saved as the hash() method in this format $2y$10$VPm9ygay2ldd0Vu0J4ttQuOdD/mIytURV/nXCXKs4GcB4AkIWtaQm instead of this: bcef5cffa6f4bb0abb94cf6fa7a7cb2f. I don't find where I have to change to save in the desired format?

Answer 1

You have to override PrestaShop and add new additional password checker:
if(!loginWithOriginalMethod($password)) {
loginWithAdditionalMethod($password);
}
By using this way, both your new and old customers can login to your store

Answer 2

If you could import the previous 1.6 hash as is directly in the DB and you kept the same cookie key, the function is backward compatible.
But if like me the 1.6 hash have been re-hashed with a new cookie key as I imported using the csv functionality, you need to update src/Core/Crypto/Hashing.php, replace the last function by:
Ensure to replace <your 1.6 cookie key> by the cookie key from Prestashop 1.6
private function initHashMethods()
{
$this->hashMethods = array(
'bcrypt' => array(
'option' => array(),
'hash' => function ($passwd, $staticSalt, $option) {
return password_hash($passwd, PASSWORD_BCRYPT);
},
'verify' => function ($passwd, $hash, $staticSalt) {
/*
* Prevent enumeration because nothing happens
* when there is no, or an invalid hash.
* Also, change the password to be sure it's not maching
* the new hash.
* The new hash is equal to 'test' in BCRYPT context.
*/
if (empty($hash)) {
$hash = '$2y$10$azRqq.pN0OlWjeVfVMZXOOwqYAx1hMfme6ZnDV.27grGOEZvG.uAO';
$passwd = 'wrongPassword';
}
return password_verify($passwd, $hash);
},
),
'md5' => array(
'option' => array(),
'hash' => function ($passwd, $staticSalt, $option) {
return md5($staticSalt . $passwd);
},
'verify' => function ($passwd, $hash, $staticSalt) {
return md5($staticSalt . $passwd) === $hash;
},
),
'bcryptmd5' => array(
'option' => array(),
'hash' => function ($passwd, $staticSalt, $option) {
return password_hash(md5('<your 1.6 cookie key>' . $passwd), PASSWORD_BCRYPT);
},
'verify' => function ($passwd, $hash, $staticSalt) {
/*
* Prevent enumeration because nothing happens
* when there is no, or an invalid hash.
* Also, change the password to be sure it's not maching
* the new hash.
* The new hash is equal to 'test' in BCRYPT context.
*/
if (empty($hash)) {
$hash = '$2y$10$azRqq.pN0OlWjeVfVMZXOOwqYAx1hMfme6ZnDV.27grGOEZvG.uAO';
$passwd = 'wrongPassword';
}
return password_verify(md5('<your 1.6 cookie key>' . $passwd), $hash);
},
),
);
}