Import external bcrypt plugin for password hashing

[ypcs]

It was noted in #216 that our project template defaults to WordPress default hashing method for password, which is still in 2024 weak MD5. There has for a long time existed mu-plugin, which can be used to replace password hashing with bcrypt.

This plugin hooks to WordPress core password handling functions, and overrides password checks so all obsolete MD5-hashed passwords will be converted to bcrypt (or whatever is in future the PHP default password hashing function).

See source code for more documentation.

Source:
https://raw.githubusercontent.com/roots/wp-password-bcrypt/master/wp-password-bcrypt.php
Original commit: <15f0d8919fb3731f79a0cf2fb47e1baecb86cb26>
License: MIT
Author: Roots
Author URI: https://roots.io

Closes: #216

[pekkakortelainen]

Test results below, any sensitive information replaced with asterisks for obvious reasons.

With initial setup:

$ wp user create testuser [email protected] --porcelain
5

$ wp user list --fields=ID,user_login,user_pass
+----+------------+--------------------------------------------------------------+
| ID | user_login | user_pass                                                    |
+----+------------+--------------------------------------------------------------+
| 5  | testuser   | $P$B******************************                           |
+----+------------+--------------------------------------------------------------+

Installed as a must-use plugin as the PR suggests:

$ l /data/wordpress/htdocs/wp-content/mu-plugins/
bedrock-autoloader.php  register-theme-directory.php  seravo-plugin/  wp-password-bcrypt.php

After mu-plugin installation the password hash remains the same (as expected and addressed in #216):

$ wp user list --fields=ID,user_login,user_pass
+----+------------+--------------------------------------------------------------+
| ID | user_login | user_pass                                                    |
+----+------------+--------------------------------------------------------------+
| 5  | testuser   | $P$B******************************                           |
+----+------------+--------------------------------------------------------------+

Force password reset on user:

$ wp user reset-password 5
Reset password for testuser.
Success: Password reset for 1 user.

Check again:

$ wp user list --fields=ID,user_login,user_pass
+----+------------+--------------------------------------------------------------+
| ID | user_login | user_pass                                                    |
+----+------------+--------------------------------------------------------------+
| 5  | testuser   | $2y$10$***************************************************** |
+----+------------+--------------------------------------------------------------+

LGTM, no warnings or errors on PHP 7.4 / 8.1 / 8.2 / 8.3.