[#48633] - [7.0] Remove deprecated `MD5Handler` class
- Pending
- Medium
- Build: 7.0-dev
- # 48633
- Diff
- lemuelvdm:remove-deprecated-MD5Handler
User tests: Successful: Unsuccessful:
Pull Request resolves # .
- I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.
Summary of Changes
Removes MD5Handler, deprecated since Joomla 4.0 and scheduled for removal in 7.0, together with:
UserHelper::HASH_MD5, its algorithm mapping, and MD5 service registration.- MD5 participation in the password-handler chain.
Adds upgrade cleanup for the deleted file and updates the PHPStan baseline and spelling-reference comment.
Testing Instructions
- Apply the patch to Joomla 7.0-dev.
- Verify frontend and administrator login with supported password hashes. Correct passwords should succeed; incorrect passwords should fail.
- Verify that salted and unsalted MD5 passwords are rejected without PHP errors.
- Reset an affected test account's password and confirm login succeeds.
- Test an upgrade with this change included and confirm
libraries/src/Authentication/Password/MD5Handler.phpis removed.
Actual result BEFORE applying this Pull Request
The deprecated MD5 handler remains registered and accepts legacy MD5 password hashes.
Expected result AFTER applying this Pull Request
MD5 password support is removed. BCrypt, Argon2i, Argon2id, and the extensible handler chain remain available.
Link to documentations
Please select:
- No documentation changes for guide.joomla.org needed
- Pull Request link for manual.joomla.org: joomla/Manual#723
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Repository Administration com_admin Libraries |
| Title |
|
||||||
| Labels |
Added:
PR-7.0-dev
|
||
I have tested this item ✅ successfully on 6df4d05
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48633.
I have tested this item ✅ successfully on 6df4d05
MD5 password support is gone, BCrypt/Argon2i/Argon2id logins still work, and the upgrade cleanup removes the old file.
Verification
7.0-dev + PR, PHP in DDEV, fresh install. Test users with hashes set directly in #__users:
| Stored hash | 7.0-dev (before) | PR (after) |
|---|---|---|
MD5 salted hash:salt, frontend |
logged in | rejected, no PHP errors |
| MD5 unsalted, frontend | logged in | rejected, no PHP errors |
| MD5 salted, Super User, backend | logged in | rejected |
| BCrypt, frontend (right / wrong pw) | — | logged in / rejected |
| Argon2id, frontend | — | logged in |
| admin (BCrypt), backend (right / wrong pw) | — | logged in / rejected |
user:reset-passwordon the unsalted MD5 user, then login → works.- Upgrade cleanup: placed a dummy
libraries/src/Authentication/Password/MD5Handler.php, ranJoomlaInstallerScript::deleteUnexistingFiles()→ dry run lists it, real run deletes it. UserHelper::hashPassword('md5')now throwsInvalidArgumentException(unsupported algorithm);HASH_MD5, the class and thepassword.handler.md5service are gone. No other core references are left.
Suggestions (non-blocking)
libraries/src/User/User.php:81: the$passworddocblock still says "MD5 encrypted password". Could be "Hashed password".- Docs: users whose stored hash is still MD5 (old 1.5/2.5/3.x imports that never logged in again) are locked out until they reset their password. That is intended, but it belongs on the manual.joomla.org 6.x → 7.0 "removed backward incompatibility" page, together with the removed class, the
HASH_MD5constant and thepassword.handler.md5service. - Title typo:
MD5Hander→MD5Handler.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48633.
| Title |
|
||||||
Hi @tecpromotion,
I've made those suggested changes and added the necessary documentation to the manual.
Thanks.
@lemuelvdm thanks for the PR, would you like to propose a new way for https://guide.joomla.org/user-guide/users/users-admin-password-recovery since using md5 passwords would no longer be possible we should provide an alternative (if possible).
I would expect bcrypt and argon is not as simple as md5 but didn't tried it yet
![avatar github-actions[bot]](/images/avatars/github-actions[bot].png)
This pull request has conflicts, please resolve those before we can evaluate the pull request.
I have tested this item ✅ successfully on 6df4d05
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48633.