Merge pull request #268 from tranquac/fix/weak-password-hashing

fix: use password_hash instead of unsalted SHA-256 for password storage

Author: icret

install/contorl.php

@@ -8,7 +8,7 @@
 if (isset($_POST['password'])) {
   if ($_POST['password'] === $_POST['repassword']) {
 
-    $config['password'] = hash('sha256', $_POST['password']);
+    $config['password'] = password_hash($_POST['password'], PASSWORD_DEFAULT);
     $config['user'] = $_POST['user'];
   } else {