The user passwords are now stored in a more secure way.

Also the password hash mechanism is changed from less secure md5 hashes to more secure cryptographic methods - including a salt.

Additionally a random secret is created and stored in the installation.ini.

The secret is not in the config in DB, so that in case of SQL injection the passwords still are encrypted with that secret on the disk.

All user passwords are additionally encrypted with that secret, so when loosing or changing that secret all users has to change their passwords!