www/nginx: move to password_hash() as suggested by @dabo-devconsole; closes #3063

www/nginx/pkg-descr

@@ -16,7 +16,7 @@ Plugin Changelog
 * rfc5746, rfc7507 and rfc8701 are taken into account on compiling and comparing tls fingerprints
 * the reason for scoring the connection as intercepted is added to the X-TLS-Client-Intercepted header. check backend settings if using this feature
 * http_post hook added to be able to map global variables
-* PHP 8 compatibility for crypt() call
+* PHP 8 compatibility: change crypt() to password_hash()
 
 1.28
 

www/nginx/src/opnsense/scripts/nginx/setup.php

@@ -228,7 +228,7 @@ foreach ($nginx->userlist->iterateItems() as $user_list) {
         foreach ($users as $user) {
             $user_node = $nginx->getNodeByReference("credential." . $user);
             $username = (string)$user_node->username;
-            $password = crypt((string)$user_node->password, '$6$');
+            $password = password_hash((string)$user_node->password, PASSWORD_DEFAULT);
             fwrite($file, $username . ':' . $password . "\n");
         }
     } finally {