<?php
namespace Api\Models;

class User extends \ActiveRecord\Model
{
    static $connection = 'public';

    static $has_many = array(
        array('members'),
        array('projects', 'through' => 'members')
    );

    static $table_name = 'users';

    public function passwordCheck($plainPassword) {
        $hashedPassword = sha1($plainPassword);
        return $hashedPassword == $this->hashed_password;
    }

    /**
     * Query for user by login
     * @param $login
     * @return \ActiveRecord\Model
     */
    static public function findByLogin($login)
    {
        return self::first(array('conditions' => array('login = ?', $login)));
    }

    /**
     * Query for user by email address
     * @param $mail
     * @return \ActiveRecord\Model
     */
    static public function findByMail($mail)
    {
        return self::first(array('conditions' => array('mail = ?', $mail)));
    }
}

<?php
namespace Api\Models;

class User extends \ActiveRecord\Model
{
    static $connection = 'public';

    static $has_many = array(
        array('members'),
        array('projects', 'through' => 'members')
    );

    static $table_name = 'users';

    public function passwordCheck($plainPassword) {
        $hashedPassword = sha1($plainPassword);
        $salt = $this->salt;
        if (isset($salt)) {
            $hashedPassword = sha1($salt . $hashedPassword);
        }
        return $hashedPassword == $this->hashed_password;
    }

    /**
     * Query for user by login
     * @param $login
     * @return \ActiveRecord\Model
     */
    static public function findByLogin($login)
    {
        return self::first(array('conditions' => array('login = ?', $login)));
    }

    /**
     * Query for user by email address
     * @param $mail
     * @return \ActiveRecord\Model
     */
    static public function findByMail($mail)
    {
        return self::first(array('conditions' => array('mail = ?', $mail)));
    }
}

Deal with salted passwords in Redmine 4
Deal with salted passwords in Redmine 4

Redmine 4 adds a salt to the SHA1-hashed passwords. If the "salt" field
of the user record is present, the hashed password is calculated by
SHA1(salt + SHA1(cleartext)) where + means string concatenation.
