commit 4ab7f824d03e5ed261b2d528e041a0b1fc2f6d0c
Author: Tomáš Šimandl <tomas.simandl@gmail.com>
Date:   Fri Nov 30 09:12:45 2018 +0100

    #5 Replace MD5 password encryption by some secure algo
    
    - BCrypt password encryption is used instead of MD5.
    - Algorithm is from springframework.security package

diff --git a/sources/create_table.sql b/sources/create_table.sql
index 5fe0cd9..374f1c8 100644
--- a/sources/create_table.sql
+++ b/sources/create_table.sql
@@ -17,7 +17,7 @@ CREATE TABLE IF NOT EXISTS `user` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `nick` varchar(50) COLLATE utf8_czech_ci NOT NULL,
   `name` varchar(255) COLLATE utf8_czech_ci NOT NULL DEFAULT '',
-  `psw` varchar(32) COLLATE utf8_czech_ci NOT NULL,
+  `psw` varchar(60) COLLATE utf8_czech_ci NOT NULL,
   `session` varchar(50) COLLATE utf8_czech_ci NOT NULL,
   `active` tinyint(1) NOT NULL,
   `created` datetime NOT NULL,
diff --git a/sources/pom.xml b/sources/pom.xml
index 0dd1062..0b58d1b 100644
--- a/sources/pom.xml
+++ b/sources/pom.xml
@@ -74,6 +74,12 @@
 
 
 
+        <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-core -->
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-core</artifactId>
+            <version>5.1.2.RELEASE</version>
+        </dependency>
         <!-- https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload -->
         <dependency>
             <groupId>commons-fileupload</groupId>
diff --git a/sources/src/main/java/cz/zcu/kiv/offscreen/user/User.java b/sources/src/main/java/cz/zcu/kiv/offscreen/user/User.java
index 7fa533d..691b541 100644
--- a/sources/src/main/java/cz/zcu/kiv/offscreen/user/User.java
+++ b/sources/src/main/java/cz/zcu/kiv/offscreen/user/User.java
@@ -1,6 +1,7 @@
 package cz.zcu.kiv.offscreen.user;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.springframework.security.crypto.bcrypt.BCrypt;
 
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
@@ -46,21 +47,20 @@ public class User {
 	 * 		   false - login failed
 	 */
 	public boolean login(String nick, String psw){
-		String qy = "SELECT * FROM user WHERE nick LIKE ? AND psw LIKE ? AND active = '1' LIMIT 1";
+		String qy = "SELECT * FROM user WHERE nick LIKE ? AND active = '1' LIMIT 1";
 
 		try{
 			PreparedStatement pst = db.getPreparedStatement(qy, false);
 			pst.setString(1, nick);
-			pst.setString(2, Util.MD5(psw));
 			ResultSet rs = db.executeQuery(pst);
 
 			if ( rs != null && rs.next() ) {
-				if(rs.getInt("id") > 0){
+				if(rs.getInt("id") > 0 && BCrypt.checkpw(psw, rs.getString("psw"))){
 					this.id = rs.getInt("id");
 					return true;
 				}
 			}
-		} catch (SQLException e) {
+		} catch (SQLException | IllegalArgumentException e) {
 			logger.error("Can not login user: ", e);
 		}
 
@@ -85,7 +85,7 @@ public class User {
 				pst.setInt(2, 1);
 				pst.setString(3, param.get("nick"));
 				pst.setString(4, param.get("name"));
-				pst.setString(5, Util.MD5(param.get("password")));
+				pst.setString(5, BCrypt.hashpw(param.get("password"), BCrypt.gensalt()));
 				pst.setString(6, param.get("session"));
 				pst.setString(7, param.get("email"));
 
diff --git a/sources/src/main/java/cz/zcu/kiv/offscreen/user/Util.java b/sources/src/main/java/cz/zcu/kiv/offscreen/user/Util.java
index c80c43d..df1f43f 100644
--- a/sources/src/main/java/cz/zcu/kiv/offscreen/user/Util.java
+++ b/sources/src/main/java/cz/zcu/kiv/offscreen/user/Util.java
@@ -5,25 +5,6 @@ import java.util.regex.Pattern;
 
 class Util {
 
-	/**
-	 *	Method do a hash code from string.
-	 *
-	 * @param md5 - String to hash
-	 * @return String - hashcode 
-	 */
-	static String MD5(String md5) {
-		   try {
-		        java.security.MessageDigest md = java.security.MessageDigest.getInstance("MD5");
-		        byte[] array = md.digest(md5.getBytes());
-		        StringBuffer sb = new StringBuffer();
-		        for (int i = 0; i < array.length; ++i) {
-		          sb.append(Integer.toHexString((array[i] & 0xFF) | 0x100).substring(1,3));
-		       }
-		        return sb.toString();
-		    } catch (java.security.NoSuchAlgorithmException e) {
-		    }
-		    return null;
-	}
 
 	static String formatDate(String date){
 		String pattern = "(\\d{4})-(\\d{2})-(\\d{2}) (\\d{2}):(\\d{2}):(\\d{2}).*";
