Don't use custom PBKDF2 function (#3952)

Instead, use golang.org/x/crypto/pbkdf2

1 files changed, 3 insertions, 1 deletions

diff --git a/models/user.go b/models/user.go
index 3e4f0f4b..0fcccae0 100644
--- a/models/user.go
+++ b/models/user.go
@@ -32,6 +32,8 @@ import (
 	"github.com/gogits/gogs/modules/log"
 	"github.com/gogits/gogs/modules/markdown"
 	"github.com/gogits/gogs/modules/setting"
+
+	"golang.org/x/crypto/pbkdf2"
 )
 
 type UserType int
@@ -315,7 +317,7 @@ func (u *User) NewGitSig() *git.Signature {
 
 // EncodePasswd encodes password to safe format.
 func (u *User) EncodePasswd() {
-	newPasswd := base.PBKDF2([]byte(u.Passwd), []byte(u.Salt), 10000, 50, sha256.New)
+	newPasswd := pbkdf2.Key([]byte(u.Passwd), []byte(u.Salt), 10000, 50, sha256.New)
 	u.Passwd = fmt.Sprintf("%x", newPasswd)
 }