[SECURITY] Fix multiple critical vulnerabilities in authentication system

[SajanGhimire1]

… key - Upgrade password generation from mt_rand() to cryptographically secure random functions - Fix weak password hashing (MD5+SHA1) by implementing password_hash() with backward compatibility - Prevent SQL injection in CopyAdminTable() with table name whitelist validation - Enable SSL verification in email sending functions - Remove debug function that could leak sensitive information - Improve token generation security

Hardcoded Cryptographic Key (CWE-321):
Fix Applied:
-Added get_crypto_key() function that generates unique keys per installation -Keys are generated using random_bytes() or openssl_random_pseudo_bytes() -Fallback mechanism with warnings for older PHP versions -Keys can be stored in configuration files outside web root

Impact: Prevents universal compromise where attackers with one installation's data can compromise ALL installations.

Weak Password Hashing (CWE-327):
Fix Applied:
-Added deprecation warning for old passwordhash() function I-mplemented password_hash() with PASSWORD_DEFAULT (bcrypt/Argon2) -Maintains backward compatibility for existing hashes -Added proper password verification with password_verify()

Impact: Passwords are now properly hashed using modern algorithms, resistant to brute force attacks.

Insecure Random Generation (CWE-338):
Fix Applied:
-Replaced mt_rand() with random_int() (PHP 7.0+)
-Fallback to openssl_random_pseudo_bytes() for older PHP -Only uses mt_rand() as last resort with security warnings
-Applied to password generation, salt creation, and token generation

Impact: Random values (passwords, salts, tokens) are now cryptographically secure and unpredictable.

#Added table name validation in CopyAdminTable()

-Enabled SSL verification - Fixed email sending security -Removed debug function - Eliminated information leakage risk