Passwords stored as unsalted MD5 hashes #1432

Summary

SQLBot's password-change path (login.py) writes md5pwd(new_pwd) to the password column, where md5pwd (common/core/security.py) is plain unsalted hashlib.md5().

Details

def md5pwd(password: str) -> str:
    m = hashlib.md5()
    ...

used directly in the password-change handler: db_user.password = md5pwd(new_pwd). No per-user salt anywhere in the function.

Affected versions: confirmed on commit d4ddf6d904b12dafada2de478ff84a22caf3a6d6.

Steps To Reproduce

(available upon request)

Impact

Any future database leak or dump makes every stored password hash crackable at rainbow-table/GPU speed with no per-user salt, far weaker than the bcrypt hashing already available elsewhere in the same codebase.