Security fix: prevent password exposure in SQL logs

- Hash password in PHP before SQL query to avoid cleartext password in logs
- Only md5(password) is sent to SQL, never the cleartext password
- Maintains OpenSimulator password verification compatibility
- Follows defense-in-depth: password and salt never coexist in PHP memory

Author: magicoli

v1/gridauth.php

@@ -31,11 +31,14 @@ function w4os_gridauth( $user, $username, $password ) {
 			return $user;
 		}
 
+		// Hash password in PHP to avoid exposing it in SQL logs
+		$password_md5 = md5( $password );
+
 		$avatar_query = "SELECT *
     FROM UserAccounts LEFT JOIN auth ON PrincipalID = UUID
     WHERE active = 1 AND Email != ''
     AND $match
-    AND passwordHash = md5(concat(md5('$password'),':', passwordSalt))
+    AND passwordHash = md5(concat('$password_md5',':', passwordSalt))
     ;";
 		$avatar_row   = $w4osdb->get_row( $avatar_query );
 		if ( is_wp_error( $avatar_row ) ) {