Index: branches/version-2_5-dev/data/class/helper/SC_Helper_Customer.php
===================================================================
--- branches/version-2_5-dev/data/class/helper/SC_Helper_Customer.php	(revision 19892)
+++ branches/version-2_5-dev/data/class/helper/SC_Helper_Customer.php	(revision 19986)
@@ -46,5 +46,5 @@
 
         foreach ($arrRegistColumn as $data) {
-            if ($data["column"] != "password") {
+            if ($data["column"] != "password" && $data["column"] != "reminder_answer" ) {
                 if($array[ $data['column'] ] != "") {
                     $arrRegist[ $data["column"] ] = $array[ $data["column"] ];
@@ -61,5 +61,17 @@
 
         //-- パスワードの更新がある場合は暗号化。（更新がない場合はUPDATE文を構成しない）
-        if ($array["password"] != DEFAULT_PASSWORD) $arrRegist["password"] = sha1($array["password"] . ":" . AUTH_MAGIC);
+        $salt = "";
+        if ($array["password"] != DEFAULT_PASSWORD) {
+            $salt = SC_Utils_Ex::sfGetRandomString(10);
+            $arrRegist["salt"] = $salt;
+            $arrRegist["password"] = SC_Utils_Ex::sfGetHashString($array["password"], $salt);
+        }
+        if ($array["reminder_answer"] != DEFAULT_PASSWORD) {
+            if($salt == "") {
+                $salt = $objQuery->get("salt", "dtb_customer", "customer_id = ? ", array($array['customer_id']));
+            }
+            $arrRegist["reminder_answer"] = SC_Utils_Ex::sfGetHashString($array["reminder_answer"], $salt);
+        }
+        
         $arrRegist["update_date"] = "NOW()";
         
@@ -82,8 +94,17 @@
         
         //-- パスワードの更新がある場合は暗号化
-        if ($array["password"] != DEFAULT_PASSWORD){
-            $array["password"] = sha1($array["password"] . ":" . AUTH_MAGIC);
+        $salt = "";
+        if ($array["password"] != DEFAULT_PASSWORD) {
+            $salt = SC_Utils_Ex::sfGetRandomString(10);
+            $array["salt"] = $salt;
+            $array["password"] = SC_Utils_Ex::sfGetHashString($array["password"], $salt);
         } else {
             unset($array["password"]);
+        }
+        if ($array["reminder_answer"] != DEFAULT_PASSWORD) {
+            if(is_numeric($customer_id) and $salt == "") {
+                $salt = $objQuery->get("salt", "dtb_customer", "customer_id = ? ", array($array['customer_id']));
+            }
+            $array["reminder_answer"] = SC_Utils_Ex::sfGetHashString($array["reminder_answer"], $salt);
         }
        
Index: branches/version-2_5-dev/data/class/pages/mypage/LC_Page_Mypage_Change.php
===================================================================
--- branches/version-2_5-dev/data/class/pages/mypage/LC_Page_Mypage_Change.php	(revision 19893)
+++ branches/version-2_5-dev/data/class/pages/mypage/LC_Page_Mypage_Change.php	(revision 19986)
@@ -160,4 +160,5 @@
             $this->arrForm['password'] = DEFAULT_PASSWORD;
             $this->arrForm['password02'] = DEFAULT_PASSWORD;
+            $this->arrForm['reminder_answer'] = DEFAULT_PASSWORD;
         }
         $this->transactionid = SC_Helper_Session_Ex::getToken();
@@ -219,4 +220,11 @@
         $objErr = new SC_CheckError($arrRet);
         $objErr->arrErr = $this->objFormParam->checkError();
+        if(isset($objErr->arrErr['password']) and $arrRet['password'] == DEFAULT_PASSWORD) {
+            unset($objErr->arrErr['password']);
+            unset($objErr->arrErr['password02']);
+        }
+        if(isset($objErr->arrErr['reminder_answer']) and $arrRet['reminder_answer'] == DEFAULT_PASSWORD) {
+            unset($objErr->arrErr['reminder_answer']);
+        }
                         
         $objErr->doFunc(array("お電話番号", "tel01", "tel02", "tel03"),array("TEL_CHECK"));
@@ -224,5 +232,7 @@
         $objErr->doFunc(array("生年月日", "year", "month", "day"), array("CHECK_BIRTHDAY"));
         if ($this->isMobile === false){
-            $objErr->doFunc(array('パスワード', 'パスワード(確認)', "password", "password02") ,array("EQUAL_CHECK"));
+            if( $arrRet['password'] != DEFAULT_PASSWORD ) {
+                $objErr->doFunc(array('パスワード', 'パスワード(確認)', "password", "password02") ,array("EQUAL_CHECK"));
+            }
             $objErr->doFunc(array('メールアドレス', 'メールアドレス(確認)', "email", "email02") ,array("EQUAL_CHECK"));
             $objErr->doFunc(array("FAX番号", "fax01", "fax02", "fax03") ,array("TEL_CHECK"));
Index: branches/version-2_5-dev/data/class/pages/admin/customer/LC_Page_Admin_Customer_Customer.php
===================================================================
--- branches/version-2_5-dev/data/class/pages/admin/customer/LC_Page_Admin_Customer_Customer.php	(revision 19829)
+++ branches/version-2_5-dev/data/class/pages/admin/customer/LC_Page_Admin_Customer_Customer.php	(revision 19986)
@@ -183,10 +183,9 @@
         }
 
-        //-- パスワードの更新がある場合は暗号化。（更新がない場合はUPDATE文を構成しない）
-        if ($array["password"] != DEFAULT_PASSWORD) {
-            $arrRegist["password"] = sha1($array["password"] . ":" . AUTH_MAGIC);
-        } else {
-            unset($arrRegist['password']);
-        }
+        //-- パスワード/リマインダーの答え暗号化。
+        $salt = SC_Utils_Ex::sfGetRandomString(10);
+        $arrRegist["salt"] = $salt;
+        $arrRegist["password"] = SC_Utils_Ex::sfGetHashString($array["password"], $salt);
+        $arrRegist["reminder_answer"] = SC_Utils_Ex::sfGetHashString($arrRegist["reminder_answer"], $salt);
 
         $arrRegist["update_date"] = "Now()";
@@ -273,7 +272,5 @@
         $objErr->doFunc(array("ご性別", "sex") ,array("SELECT_CHECK", "NUM_CHECK"));
         $objErr->doFunc(array("ご職業", "job") ,array("NUM_CHECK"));
-        if ($array["password"] != DEFAULT_PASSWORD) {
-            $objErr->doFunc(array("パスワード", 'password', PASSWORD_LEN1, PASSWORD_LEN2), array("EXIST_CHECK", "ALNUM_CHECK", "NUM_RANGE_CHECK"));
-        }
+        $objErr->doFunc(array("パスワード", 'password', PASSWORD_LEN1, PASSWORD_LEN2), array("EXIST_CHECK", "ALNUM_CHECK", "NUM_RANGE_CHECK"));
         $objErr->doFunc(array("パスワードを忘れたときのヒント 質問", "reminder") ,array("SELECT_CHECK", "NUM_CHECK"));
         $objErr->doFunc(array("パスワードを忘れたときのヒント 答え", "reminder_answer", STEXT_LEN) ,array("EXIST_CHECK", "MAX_LENGTH_CHECK"));
Index: branches/version-2_5-dev/data/class/pages/admin/customer/LC_Page_Admin_Customer_Edit.php
===================================================================
--- branches/version-2_5-dev/data/class/pages/admin/customer/LC_Page_Admin_Customer_Edit.php	(revision 19892)
+++ branches/version-2_5-dev/data/class/pages/admin/customer/LC_Page_Admin_Customer_Edit.php	(revision 19986)
@@ -150,4 +150,5 @@
 
             $this->list_data["password"] = DEFAULT_PASSWORD;
+            $this->list_data["reminder_answer"] = DEFAULT_PASSWORD;
             //DB登録のメールアドレスを渡す
             $this->tpl_edit_email = $result[0]['email'];
@@ -294,5 +295,7 @@
         }
         $objErr->doFunc(array("パスワードを忘れたときのヒント 質問", "reminder") ,array("SELECT_CHECK", "NUM_CHECK"));
-        $objErr->doFunc(array("パスワードを忘れたときのヒント 答え", "reminder_answer", STEXT_LEN) ,array("EXIST_CHECK", "MAX_LENGTH_CHECK"));
+        if ($array["reminder_answer"] != DEFAULT_PASSWORD) {
+            $objErr->doFunc(array("パスワードを忘れたときのヒント 答え", "reminder_answer", STEXT_LEN) ,array("EXIST_CHECK", "MAX_LENGTH_CHECK"));
+        }
         $objErr->doFunc(array("メールマガジン", "mailmaga_flg") ,array("SELECT_CHECK", "NUM_CHECK"));
         $objErr->doFunc(array("生年月日", "year", "month", "day"), array("CHECK_DATE"));
Index: branches/version-2_5-dev/data/class/pages/admin/LC_Page_Admin_Login.php
===================================================================
--- branches/version-2_5-dev/data/class/pages/admin/LC_Page_Admin_Login.php	(revision 19943)
+++ branches/version-2_5-dev/data/class/pages/admin/LC_Page_Admin_Login.php	(revision 19986)
@@ -102,5 +102,5 @@
     /* 認証パスワードの判定 */
     function fnCheckPassword(&$objQuery) {
-        $sql = "SELECT member_id, password, authority, login_date, name FROM dtb_member WHERE login_id = ? AND del_flg <> 1 AND work = 1";
+        $sql = "SELECT member_id, password, salt, authority, login_date, name FROM dtb_member WHERE login_id = ? AND del_flg <> 1 AND work = 1";
         $arrcol = array ($_POST['login_id']);
         // DBから暗号化パスワードを取得する。
@@ -108,8 +108,8 @@
         // パスワードの取得
         $password = $data_list[0]['password'];
+        // saltの取得
+        $salt = $data_list[0]['salt'];
         // ユーザ入力パスワードの判定
-        $ret = sha1($_POST['password'] . ":" . AUTH_MAGIC);
-
-        if ($ret == $password) {
+        if (SC_Utils_Ex::sfIsMatchHashPassword($_POST['password'], $password, $salt)) {
                // セッション登録
             $this->fnSetLoginSession($data_list[0]['member_id'], $data_list[0]['authority'], $data_list[0]['login_date'], $data_list[0]['name']);
Index: branches/version-2_5-dev/data/class/pages/admin/system/LC_Page_Admin_System_Input.php
===================================================================
--- branches/version-2_5-dev/data/class/pages/admin/system/LC_Page_Admin_System_Input.php	(revision 19977)
+++ branches/version-2_5-dev/data/class/pages/admin/system/LC_Page_Admin_System_Input.php	(revision 19986)
@@ -365,9 +365,11 @@
 
         // INSERTする値を作成する.
+        $salt                  = SC_Utils_Ex::sfGetRandomString(10);
         $sqlVal = array();
         $sqlVal['name']        = $arrMemberData['name'];
         $sqlVal['department']  = $arrMemberData['department'];
         $sqlVal['login_id']    = $arrMemberData['login_id'];
-        $sqlVal['password']    = sha1($arrMemberData['password'] . ':' . AUTH_MAGIC);
+        $sqlVal['password']    = SC_Utils_Ex::sfGetHashString($arrMemberData['password'], $salt);
+        $sqlVal['salt']        = $salt;
         $sqlVal['authority']   = $arrMemberData['authority'];
         $sqlVal['rank']        = $objQuery->max('rank', 'dtb_member') + 1;
@@ -401,5 +403,7 @@
         $sqlVal['update_date'] = 'NOW()';
         if($arrMemberData['password'] != DUMMY_PASS) {
-            $sqlVal['password'] = sha1($arrMemberData['password'] . ":" . AUTH_MAGIC);
+            $salt = SC_Utils_Ex::sfGetRandomString(10);
+            $sqlVal['salt']     = $salt;
+            $sqlVal['password'] = SC_Utils_Ex::sfGetHashString($arrMemberData['password'], $salt);
         }
 
Index: branches/version-2_5-dev/data/class/SC_Customer.php
===================================================================
--- branches/version-2_5-dev/data/class/SC_Customer.php	(revision 19860)
+++ branches/version-2_5-dev/data/class/SC_Customer.php	(revision 19986)
@@ -51,5 +51,5 @@
 
         // パスワードが合っていれば顧客情報をcustomer_dataにセットしてtrueを返す
-        if ( sha1($pass . ":" . AUTH_MAGIC) == $data['password'] ){
+        if ( SC_Utils_Ex::sfIsMatchHashPassword($pass, $data['password'], $data['salt']) ) {
             $this->customer_data = $data;
             $this->startSession();
@@ -150,5 +150,5 @@
 
         // パスワードが合っている場合は、顧客情報をcustomer_dataに格納してtrueを返す。
-        if (sha1($pass . ':' . AUTH_MAGIC) == @$data['password']) {
+        if ( SC_Utils_Ex::sfIsMatchHashPassword($pass, $data['password'], $data['salt']) ) {
             $this->customer_data = $data;
             $this->startSession();
Index: branches/version-2_5-dev/data/class/util/SC_Utils.php
===================================================================
--- branches/version-2_5-dev/data/class/util/SC_Utils.php	(revision 19972)
+++ branches/version-2_5-dev/data/class/util/SC_Utils.php	(revision 19986)
@@ -2247,4 +2247,51 @@
         return true;
     }
+
+    /**
+     * パスワードのハッシュ化
+     *
+     * @param string $str 暗号化したい文言
+     * @param string $salt salt
+     * @return string ハッシュ暗号化された文字列
+     */
+    function sfGetHashString($str, $salt) {
+        $res = '';
+        if ($salt == '') {
+            $salt = AUTH_MAGIC;
+        }
+        if ( AUTH_TYPE == 'PLAIN') {
+            $res = $str;
+        } else {
+            $res = hash_hmac(PASSWORD_HASH_ALGOS, $str . ":" . AUTH_MAGIC, $salt);
+        }
+        return $res;
+    }
+    
+    /**
+     * パスワード文字列のハッシュ一致判定
+     *
+     * @param string $pass 確認したいパスワード文字列
+     * @param string $hashpass 確認したいパスワードハッシュ文字列
+     * @param string $salt salt
+     * @return boolean 一致判定
+     */
+    function sfIsMatchHashPassword($pass, $hashpass, $salt) {
+        $res = false;
+        if ($hashpass != '') {
+            if (AUTH_TYPE == 'PLAIN') {
+                if($pass === $hashpass) {
+                    $res = true;
+                }
+            } else {
+                $hash = SC_Utils_Ex::sfGetHashString($pass, $salt);
+                if($hash === $hashpass) {
+                    $res = true;
+                }
+            }
+        }
+        return $res;
+    }
+    
+
 }
 ?>