Index: main/plugin-core/plugin.xml
===================================================================
--- main/plugin-core/plugin.xml	(revision 26170)
+++ main/plugin-core/plugin.xml	(working copy)
@@ -31,6 +31,32 @@
 	 -->
 
     <config>
+    	<!-- Login security parameter -->
+    	<param id="runtime.login.security.level" type="string">
+            <!-- 
+                This parameter defines the security level of the login.
+             -->
+            <label i18n="true">PLUGINS_CORE_SECURITY_LEVEL_LOGIN_LABEL</label>
+            <description i18n="true">PLUGINS_CORE_SECURITY_LEVEL_LOGIN_DESCRIPTION</description>
+            <enumeration>
+            	<entry>
+            		<label i18n="true">PLUGINS_CORE_SECURITY_LEVEL_LOGIN_HIGH</label>
+        			<value>high</value>
+            	</entry>
+        		<entry>
+            		<label i18n="true">PLUGINS_CORE_SECURITY_LEVEL_LOGIN_LOW</label>
+            		<value>low</value>
+        		</entry>
+        	</enumeration>
+        	<validation>
+                <mandatory/>
+            </validation>
+            <default-value>2</default-value>
+            <category i18n="true">PLUGINS_CORE_SECURITY_LEVEL_LOGIN_CONFIG_CATEGORY</category>
+            <group i18n="true">PLUGINS_CORE_SECURITY_LEVEL_LOGIN_CONFIG_CATEGORY_GROUP</group>
+            <order>1</order>
+        </param>
+    
         <!-- Debug parameters -->
         <param id="runtime.debug.ui" type="boolean">
             <!-- 
@@ -1246,7 +1272,8 @@
         <!-- 
             The same as runtime.user.impl.jdbc.core but where users can be authentified through the API
             @see:plugin{feature/runtime.user.impl.jdbc.core}
-         -->
+         -->         
+         
         <extensions>
             <extension point="org.ametys.runtime.user.UsersManager"
                        id="org.ametys.runtime.plugins.core.user.CoreCredentialsAwareJdbc"
@@ -1254,6 +1281,7 @@
                        logger="org.ametys.runtime.plugins.core.users.jdbc.credential">
                 <pool>runtime.datasource.core.jdbc.pool</pool>
                 <table>Users</table>
+                <salt column="salt"/>
                 <param id="login"/>
                 <param id="password"/>
                 <param id="firstname"/>
@@ -1277,6 +1305,7 @@
                        logger="org.ametys.runtime.plugins.core.users.jdbc.credentialmodifiable">
                 <pool>runtime.datasource.core.jdbc.pool</pool>
                 <table>Users</table>
+                <salt column="salt"/>
                 <param id="login"/>
                 <param id="password"/>
                 <param id="firstname"/>
@@ -1984,6 +2013,10 @@
         	This features defines the form based credential provider. Data are sent to the provider through a
         	html form. If the option is enabled, user's data can be stored with a cookie.
          -->
+        <config>
+            <param-ref id="runtime.login.security.level"/>
+        </config>
+         
         <extensions>
             <extension point="org.ametys.runtime.authentication.CredentialsProvider"
                        id="org.ametys.runtime.plugins.core.authentication.FormBased"
@@ -1992,6 +2025,8 @@
             	<username-field>Username</username-field>
             	<password-field>Password</password-field>
             	<rememberMe-field>rememberMe</rememberMe-field>
+            	<captchaKey-field>captcha-key</captchaKey-field>
+            	<captchaAnswer-field>captcha</captchaAnswer-field>
             	<cookie>
             		<cookieEnabled>true</cookieEnabled>
             		<cookieLifeTime>604800</cookieLifeTime>
Index: main/plugin-core/src/org/ametys/runtime/plugins/core/authentication/FormBasedCredentialsProvider.java
===================================================================
--- main/plugin-core/src/org/ametys/runtime/plugins/core/authentication/FormBasedCredentialsProvider.java	(revision 26170)
+++ main/plugin-core/src/org/ametys/runtime/plugins/core/authentication/FormBasedCredentialsProvider.java	(working copy)
@@ -35,8 +35,10 @@
 import org.apache.cocoon.environment.http.HttpCookie;
 import org.apache.commons.lang.StringUtils;
 
+import org.ametys.cms.captcha.CaptchaHelper;
 import org.ametys.runtime.authentication.Credentials;
 import org.ametys.runtime.authentication.CredentialsProvider;
+import org.ametys.runtime.config.Config;
 import org.ametys.runtime.workspace.WorkspaceMatcher;
 
 /**
@@ -74,12 +76,23 @@
     /** Password value in case of info retrieved from cookie */
     public static final String AUTHENTICATION_BY_COOKIE = "authentication_by_cookie";
     
+    /** Low security level */
+    public static final String SECURITY_LEVEL_LOW = "low";
+    /** High security level */
+    public static final String SECURITY_LEVEL_HIGH = "high";
+    
     /** Name of the user name html field */
     protected String _usernameField;
 
     /** Name of the user password html field */
     protected String _passwordField;
     
+    /** Name of the captcha answer html field */
+    protected String _captchaField;
+
+    /** Name of the captcha key html field */
+    protected String _captchaKeyField;
+    
     /** Name of the "remember me" html field */
     protected String _rememberMeField;
 
@@ -180,29 +193,33 @@
         {
             getLogger().info("URL accepted : " + url);
         }
-        
+
         return accept;
     }
     
     public void allowed(Redirector redirector)
     {
-        Request request = ContextHelper.getRequest(_context);
-        
-        String value = getCookieValue(request, _cookieName);
-        if (value != null && !"".equals(value))
-        {
-            updateCookie(value, _cookieName, (int) _cookieLifetime, _context);
-        }
-        else
+        String level = Config.getInstance().getValueAsString("runtime.login.security.level");
+        if (level.equals(SECURITY_LEVEL_LOW))
         {
-            String login = request.getParameter(_usernameField);
-            String password = request.getParameter(_passwordField);
-            String rememberMe = request.getParameter(_rememberMeField);
-            if (rememberMe != null)
+            Request request = ContextHelper.getRequest(_context);
+           
+            String value = getCookieValue(request, _cookieName);
+            if (value != null && !"".equals(value))
+            {
+                updateCookie(value, _cookieName, (int) _cookieLifetime, _context);
+            }
+            else
             {
-                if (rememberMe.equalsIgnoreCase("true"))
+                String login = request.getParameter(_usernameField);
+                String password = request.getParameter(_passwordField);
+                String rememberMe = request.getParameter(_rememberMeField);
+                if (rememberMe != null)
                 {
-                    updateCookie(login + "/n" + password, _cookieName, (int) _cookieLifetime, _context);
+                    if (rememberMe.equalsIgnoreCase("true"))
+                    {
+                        updateCookie(login + "/n" + password, _cookieName, (int) _cookieLifetime, _context);
+                    }
                 }
             }
         }
@@ -217,7 +234,20 @@
 
         if (login != null && password != null)
         {
+            String level = Config.getInstance().getValueAsString("runtime.login.security.level");
+            if (level.equals(SECURITY_LEVEL_HIGH))
+            {
+                String answer = request.getParameter(_captchaField);
+                String captchaKey = request.getParameter(_captchaKeyField);
+                
+                if (captchaKey == null || !CaptchaHelper.checkAndInvalidate(captchaKey, answer)) 
+                {
+                    return null;
+                }
+            }
+            
             return new Credentials(login, password);
+            
         }
 
         String value = getCookieValue(request, _cookieName);
@@ -272,6 +302,8 @@
     {
         _usernameField = configuration.getChild("username-field").getValue("Username");
         _passwordField = configuration.getChild("password-field").getValue("Password");
+        _captchaField = configuration.getChild("captchaAnswer-field").getValue("captcha");
+        _captchaKeyField = configuration.getChild("captchaKey-field").getValue("captcha-key");
         _rememberMeField =  configuration.getChild("rememberMe-field").getValue("rememberMe");
         _cookieEnabled = configuration.getChild("cookie").getChild("cookieEnabled").getValueAsBoolean(true);
         _cookieLifetime = configuration.getChild("cookie").getChild("cookieLifeTime").getValueAsLong(604800);
Index: main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/ModifiableJdbcUsersManager.java
===================================================================
--- main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/ModifiableJdbcUsersManager.java	(revision 26170)
+++ main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/ModifiableJdbcUsersManager.java	(working copy)
@@ -27,6 +27,8 @@
 
 import org.apache.cocoon.xml.AttributesImpl;
 import org.apache.cocoon.xml.XMLUtils;
+import org.apache.commons.codec.digest.DigestUtils;
+import org.apache.commons.lang.RandomStringUtils;
 import org.xml.sax.ContentHandler;
 import org.xml.sax.SAXException;
 
@@ -219,7 +221,14 @@
         return errorFields;
     }
     
-    private PreparedStatement createAddStatement(Connection con, Map<String, String> userInformation) throws SQLException
+    /**
+     * Create Add statement
+     * @param con The sql connection
+     * @param userInformation the user informations
+     * @return The statement
+     * @throws SQLException
+     */
+    protected PreparedStatement createAddStatement(Connection con, Map<String, String> userInformation) throws SQLException
     {
         String beginClause = "INSERT INTO " + _tableName + " (";
         String middleClause = ") VALUES (";
@@ -249,21 +258,7 @@
         int i = 1;
         for (JdbcParameter parameter : _parameters.values())
         {
-            if (parameter.getType() == ParameterType.PASSWORD)
-            {
-                String encryptedPassword = StringUtils.md5Base64(userInformation.get(parameter.getId()));
-                if (encryptedPassword == null)
-                {
-                    String message = "Cannot encode password";
-                    getLogger().error(message);
-                    throw new SQLException(message);
-                }
-                stmt.setString(i++, encryptedPassword);
-            }
-            else
-            {
-                stmt.setString(i++, userInformation.get(parameter.getId()));
-            }
+            stmt.setString(i++, userInformation.get(parameter.getId()));
         }
         
         return stmt;
@@ -356,8 +351,15 @@
             ConnectionHelper.cleanup(con);
         }
     }
-
-    private PreparedStatement createModifyStatement(Connection con, Map<String, String> userInformation) throws SQLException
+    
+    /**
+     * Create Update statement
+     * @param con The sql connection
+     * @param userInformation the user informations
+     * @return The statement
+     * @throws SQLException
+     */
+    protected PreparedStatement createModifyStatement(Connection con, Map<String, String> userInformation) throws SQLException
     {
         // Contruire la requête pour modifier un utilisateur
         String beginClause = "UPDATE " + _tableName + " SET ";
@@ -376,8 +378,7 @@
                 columnNames.append(parameter.getColumn() + " = ?");
             }
         }
-        
-        
+          
         String sqlRequest = beginClause + columnNames.toString() + endClause;
         if (getLogger().isDebugEnabled())
         {
@@ -390,7 +391,13 @@
         return stmt;
     }
     
-    private void _fillModifyStatement(PreparedStatement stmt, Map<String, String> userInformation) throws SQLException
+    /**
+     * Fill the statement with the user informations
+     * @param stmt The statement of the sql request
+     * @param userInformation the user informations
+     * @throws SQLException
+     */
+    protected void _fillModifyStatement(PreparedStatement stmt, Map<String, String> userInformation) throws SQLException
     {
         int index = 1;
         for (String id : userInformation.keySet())
@@ -398,24 +405,7 @@
             JdbcParameter parameter = _parameters.get(id);
             if (parameter != null && !"login".equals(id))
             {
-                if (parameter.getType() == ParameterType.PASSWORD)
-                {
-                    if (userInformation.get(parameter.getId()) != null)
-                    {
-                        String encryptedPassword = StringUtils.md5Base64(userInformation.get(parameter.getId()));
-                        if (encryptedPassword == null)
-                        {
-                            String message = "Cannot encrypt password";
-                            getLogger().error(message);
-                            throw new SQLException(message);
-                        }
-                        stmt.setString(index++, encryptedPassword);
-                    }
-                }
-                else
-                {
-                    stmt.setString(index++, userInformation.get(parameter.getId()));
-                }
+                stmt.setString(index++, userInformation.get(parameter.getId()));
             }
         }
         stmt.setString(index++, userInformation.get("login"));
Index: main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/CredentialsAwareJdbcUsersManager.java
===================================================================
--- main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/CredentialsAwareJdbcUsersManager.java	(revision 26170)
+++ main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/CredentialsAwareJdbcUsersManager.java	(working copy)
@@ -30,6 +30,8 @@
 
 import org.apache.avalon.framework.configuration.Configuration;
 import org.apache.avalon.framework.configuration.ConfigurationException;
+import org.apache.commons.codec.digest.DigestUtils;
+import org.apache.commons.lang.RandomStringUtils;
 
 
 /**
@@ -43,6 +45,9 @@
  */
 public class CredentialsAwareJdbcUsersManager extends JdbcUsersManager implements CredentialsAwareUsersManager
 {
+    /** The salt column */
+    protected String _saltColumn;
+    
     @Override
     public void configure(Configuration configuration) throws ConfigurationException
     {
@@ -54,6 +59,8 @@
             getLogger().error(message);
             throw new ConfigurationException(message, configuration);
         }
+        
+        _saltColumn = configuration.getChild("salt", true).getAttribute("column", "salt");
     }
 
     @Override
@@ -104,28 +111,46 @@
             con = ConnectionHelper.getConnection(_poolName);
 
             // Contruire la requête pour authentifier l'utilisateur
-            String sql = "SELECT " + _parameters.get("login").getColumn() + " FROM " + _tableName + " WHERE " + _parameters.get("login").getColumn() + " = ? " + " AND " + _parameters.get("password").getColumn() + " = ? ";
+            String sql = "SELECT " + _parameters.get("login").getColumn() + ", " + _parameters.get("password").getColumn() + ", " + _saltColumn + " FROM " + _tableName + " WHERE " + _parameters.get("login").getColumn() + " = ?";
             if (getLogger().isDebugEnabled())
             {
                 getLogger().debug(sql);
             }
-
-            String encryptedPassword = StringUtils.md5Base64(password);
-            if (encryptedPassword == null)
-            {
-                getLogger().error("Unable to encrypt password");
-                return false;
-            }
-
+            
+            // Effectuer la requête
             stmt = con.prepareStatement(sql);
             stmt.setString(1, login);
-            stmt.setString(2, encryptedPassword);
 
-            // Effectuer la requête
             rs = stmt.executeQuery();
 
-            // L'utilisateur est authentifié si l'on a bien une ligne de résultat
-            return rs.next();
+            if (rs.next()) 
+            {
+                String passCrypt = rs.getString(_parameters.get("password").getColumn());
+                String saltKey = rs.getString(_saltColumn);
+
+                String encryptedPassword = null;
+                
+                if (saltKey == null || _isMD5Encrypted(passCrypt))
+                {
+                    encryptedPassword = StringUtils.md5Base64(password);
+                }
+                else
+                {
+                    encryptedPassword = DigestUtils.sha256Hex(saltKey + password);
+                }
+                
+                if (encryptedPassword == null)
+                {
+                    getLogger().error("Unable to encrypt password");
+                    return false;
+                }
+                
+                return passCrypt.equals(encryptedPassword);
+            }
+            else
+            {
+                return false;
+            }
         }
         catch (SQLException e)
         {
@@ -140,4 +165,14 @@
             ConnectionHelper.cleanup(con);
         }
     }
+    
+    /**
+     * Determines if the password is encrypted with MD5 algorithm
+     * @param password The encrypted password
+     * @return true if the password is encrypted with MD5 algorithm
+     */
+    protected boolean _isMD5Encrypted(String password)
+    {
+        return password.length() == 24;
+    }
 }
Index: main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/ModifiableCredentialsAwareJdbcUsersManager.java
===================================================================
--- main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/ModifiableCredentialsAwareJdbcUsersManager.java	(revision 26170)
+++ main/plugin-core/src/org/ametys/runtime/plugins/core/user/jdbc/ModifiableCredentialsAwareJdbcUsersManager.java	(working copy)
@@ -19,6 +19,7 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.util.Map;
 
 import org.ametys.runtime.authentication.Credentials;
 import org.ametys.runtime.datasource.ConnectionHelper;
@@ -30,6 +31,8 @@
 
 import org.apache.avalon.framework.configuration.Configuration;
 import org.apache.avalon.framework.configuration.ConfigurationException;
+import org.apache.commons.codec.digest.DigestUtils;
+import org.apache.commons.lang.RandomStringUtils;
 
 
 /**
@@ -42,6 +45,9 @@
  */
 public class ModifiableCredentialsAwareJdbcUsersManager extends ModifiableJdbcUsersManager implements CredentialsAwareUsersManager
 {
+    /** The salt column */
+    protected String _saltColumn;
+    
     @Override
     public void configure(Configuration configuration) throws ConfigurationException
     {
@@ -53,6 +59,8 @@
             getLogger().error(message);
             throw new ConfigurationException(message, configuration);
         }
+        
+        _saltColumn = configuration.getChild("salt", true).getAttribute("column", "salt");
     }
 
     @Override
@@ -90,7 +98,7 @@
     {
         String login = credentials.getLogin();
         String password = credentials.getPassword();
-        
+      
         Connection con = null;
         PreparedStatement stmt = null;
         ResultSet rs = null;
@@ -101,28 +109,57 @@
             con = ConnectionHelper.getConnection(_poolName);
 
             // Contruire la requête pour authentifier l'utilisateur
-            String sql = "SELECT " + _parameters.get("login").getColumn() + " FROM " + _tableName + " WHERE " + _parameters.get("login").getColumn() + " = ? " + " AND " + _parameters.get("password").getColumn() + " = ? ";
+            String sql = "SELECT " + _parameters.get("login").getColumn() + ", " + _parameters.get("password").getColumn() + ", " + _saltColumn + " FROM " + _tableName + " WHERE " + _parameters.get("login").getColumn() + " = ?";
             if (getLogger().isDebugEnabled())
             {
                 getLogger().debug(sql);
             }
 
-            String encryptedPassword = StringUtils.md5Base64(password);
-            if (encryptedPassword == null)
-            {
-                getLogger().error("Unable to encrypt password");
-                return false;
-            }
-
+            // Effectuer la requête
             stmt = con.prepareStatement(sql);
             stmt.setString(1, login);
-            stmt.setString(2, encryptedPassword);
 
-            // Effectuer la requête
             rs = stmt.executeQuery();
 
-            // L'utilisateur est authentifié si l'on a bien une ligne de résultat
-            return rs.next();
+            if (rs.next()) 
+            {
+                String passCrypt = rs.getString(_parameters.get("password").getColumn());
+                String saltKey = rs.getString(_saltColumn);
+
+                if (saltKey == null || _isMD5Encrypted(passCrypt))
+                {
+                    String encryptedPassword = StringUtils.md5Base64(password);
+                    if (encryptedPassword == null)
+                    {
+                        getLogger().error("Unable to encrypt password with MD5 algorithm");
+                        return false;
+                    }
+                    
+                    if (passCrypt.equals(encryptedPassword))
+                    {
+                        _updateToSSHAPaswword(login, password);
+                        return true;
+                    }
+                    else
+                    {
+                        return false;
+                    }
+                }
+                else
+                {
+                    String encryptedPassword = DigestUtils.sha256Hex(saltKey + password);
+                    if (encryptedPassword == null)
+                    {
+                        getLogger().error("Unable to encrypt password with SHA2 algorithm");
+                        return false;
+                    }
+                    return passCrypt.contentEquals(encryptedPassword);
+                }
+            }
+            else
+            {
+                return false;
+            }
         }
         catch (SQLException e)
         {
@@ -137,4 +174,181 @@
             ConnectionHelper.cleanup(con);
         }
     }
+    
+    /**
+     * Determines if the password is encrypted with MD5 algorithm
+     * @param password The encrypted password
+     * @return true if the password is encrypted with MD5 algorithm
+     */
+    protected boolean _isMD5Encrypted(String password)
+    {
+        return password.length() == 24;
+    }
+    
+    /**
+     * generate a salt key and encrypt the password with the sha2 algorithm
+     * @param login
+     * @param password
+     */
+    protected void _updateToSSHAPaswword(String login, String password)
+    {
+        Connection con = null;
+        PreparedStatement stmt = null;
+        ResultSet rs = null;
+
+        try
+        {
+            con = ConnectionHelper.getConnection(_poolName);
+
+            String generateSaltKey = RandomStringUtils.randomAlphanumeric(48);
+            String newPassword = DigestUtils.sha256Hex(generateSaltKey + password);
+
+            String sqlUpdate = "UPDATE " + _tableName + " SET " + _parameters.get("password").getColumn() + " = ?, " + _saltColumn + " = ? WHERE " + _parameters.get("login").getColumn() + " = ?";
+            if (getLogger().isDebugEnabled())
+            {
+                getLogger().debug(sqlUpdate);
+            }
+
+            stmt = con.prepareStatement(sqlUpdate);
+
+            stmt.setString(1, newPassword);
+            stmt.setString(2, generateSaltKey);
+            stmt.setString(3, login);
+
+            stmt.execute();
+        }
+        catch (SQLException e)
+        {
+            getLogger().error("Error during the connection to the database", e);
+        }
+        finally
+        {
+            // Fermer les ressources de connexion
+            ConnectionHelper.cleanup(rs);
+            ConnectionHelper.cleanup(stmt);
+            ConnectionHelper.cleanup(con);
+        }
+    }
+    
+    @Override
+    protected PreparedStatement createAddStatement(Connection con, Map<String, String> userInformation) throws SQLException
+    {
+        String beginClause = "INSERT INTO " + _tableName + " (";
+        String middleClause = ") VALUES (";
+        String endClause = ")";
+        
+        StringBuffer intoClause = new StringBuffer();
+        
+        intoClause.append(_saltColumn);
+        StringBuffer valueClause = new StringBuffer();
+        valueClause.append("?");
+        
+        for (JdbcParameter parameter : _parameters.values())
+        {
+            intoClause.append(", " + parameter.getColumn());
+            valueClause.append(", ?");
+        }
+        
+        String sqlRequest = beginClause + intoClause.toString() + middleClause + valueClause + endClause;
+        if (getLogger().isDebugEnabled())
+        {
+            getLogger().debug(sqlRequest);
+        }
+        
+        PreparedStatement stmt = con.prepareStatement(sqlRequest);
+
+        int i = 1;
+        String generateSaltKey = RandomStringUtils.randomAlphanumeric(48);
+        stmt.setString(i++, generateSaltKey);
+        
+        for (JdbcParameter parameter : _parameters.values())
+        {
+            if (parameter.getType() == ParameterType.PASSWORD)
+            {
+                String encryptedPassword = DigestUtils.sha256Hex(generateSaltKey + userInformation.get(parameter.getId()));
+                if (encryptedPassword == null)
+                {
+                    String message = "Cannot encode password";
+                    getLogger().error(message);
+                    throw new SQLException(message);
+                }
+                stmt.setString(i++, encryptedPassword);
+            }
+            else
+            {
+                stmt.setString(i++, userInformation.get(parameter.getId()));
+            }
+        }
+        
+        return stmt;
+    }
+    
+    @Override
+    protected PreparedStatement createModifyStatement(Connection con, Map<String, String> userInformation) throws SQLException
+    {
+        // Contruire la requête pour modifier un utilisateur
+        String beginClause = "UPDATE " + _tableName + " SET ";
+        String endClause = " WHERE " + _parameters.get("login").getColumn() + " = ?";
+
+        StringBuffer columnNames = new StringBuffer("");
+        columnNames.append(_saltColumn + " = ?");
+        for (String id : userInformation.keySet())
+        {
+            JdbcParameter parameter = _parameters.get(id);
+            if (parameter != null && !"login".equals(id) && !(parameter.getType() == ParameterType.PASSWORD && (userInformation.get(parameter.getId()) == null)))
+            {
+                if (columnNames.length() > 0)
+                {
+                    columnNames.append(", ");
+                }
+                columnNames.append(parameter.getColumn() + " = ?");
+            }
+        }
+          
+        String sqlRequest = beginClause + columnNames.toString() + endClause;
+        if (getLogger().isDebugEnabled())
+        {
+            getLogger().debug(sqlRequest);
+        }
+
+        PreparedStatement stmt = con.prepareStatement(sqlRequest);
+        _fillModifyStatement(stmt, userInformation);
+
+        return stmt;
+    }
+    
+    @Override
+    protected void _fillModifyStatement(PreparedStatement stmt, Map<String, String> userInformation) throws SQLException
+    {
+        int index = 1;
+        String generateSaltKey = RandomStringUtils.randomAlphanumeric(48);
+        stmt.setString(index++, generateSaltKey);
+
+        for (String id : userInformation.keySet())
+        {
+            JdbcParameter parameter = _parameters.get(id);
+            if (parameter != null && !"login".equals(id))
+            {
+                if (parameter.getType() == ParameterType.PASSWORD)
+                {
+                    if (userInformation.get(parameter.getId()) != null)
+                    {
+                        String encryptedPassword = DigestUtils.sha256Hex(generateSaltKey + userInformation.get(parameter.getId()));
+                        if (encryptedPassword == null)
+                        {
+                            String message = "Cannot encrypt password";
+                            getLogger().error(message);
+                            throw new SQLException(message);
+                        }
+                        stmt.setString(index++, encryptedPassword);
+                    }
+                }
+                else
+                {
+                    stmt.setString(index++, userInformation.get(parameter.getId()));
+                }
+            }
+        }
+        stmt.setString(index++, userInformation.get("login"));
+    }
 }
Index: main/plugin-core/i18n/messages_fr.xml
===================================================================
--- main/plugin-core/i18n/messages_fr.xml	(revision 26170)
+++ main/plugin-core/i18n/messages_fr.xml	(working copy)
@@ -257,6 +257,13 @@
 
     <message key="PLUGINS_CORE_VALIDATOR_TEXT_MAXLENGTH">La valeur de ce champ est trop longue</message>
 
+	<!-- SECURITY LEVEL CORE -->
+	<message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_LABEL">Niveau de sécurité</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_DESCRIPTION">Niveau de sécurité du formulaire de connexion</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_HIGH">Fort</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_LOW">Faible</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_CONFIG_CATEGORY">Connexion back-office</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_CONFIG_CATEGORY_GROUP">Formulaire de connexion</message>
 
     <!-- DATASOURCE CORE -->
     <message key="PLUGINS_CORE_DATASOURCE_CORE_CONFIG_JDBC_CATEGORY_DATASOURCE">Base de données</message>
Index: main/plugin-core/i18n/messages_en.xml
===================================================================
--- main/plugin-core/i18n/messages_en.xml	(revision 26170)
+++ main/plugin-core/i18n/messages_en.xml	(working copy)
@@ -257,6 +257,14 @@
     
     <message key="PLUGINS_CORE_VALIDATOR_TEXT_MAXLENGTH">The value of this field is too long</message>
 
+	<!-- SECURITY LEVEL CORE -->
+	<message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_LABEL">Security level</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_DESCRIPTION">Security level of the autentification form</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_HIGH">High</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_LOW">Low</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_CONFIG_CATEGORY">Back-office connexion</message>
+    <message key="PLUGINS_CORE_SECURITY_LEVEL_LOGIN_CONFIG_CATEGORY_GROUP">Connexion form</message>
+
     <!-- DATASOURCE CORE -->
     <message key="PLUGINS_CORE_DATASOURCE_CORE_CONFIG_JDBC_CATEGORY_DATASOURCE">Database</message>
 
