Index: com/xpn/xwiki/objects/classes/PasswordClass.java
===================================================================
--- com/xpn/xwiki/objects/classes/PasswordClass.java	(revision 1300)
+++ com/xpn/xwiki/objects/classes/PasswordClass.java	(working copy)
@@ -22,8 +22,11 @@
 
 package com.xpn.xwiki.objects.classes;
 
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
 import org.apache.ecs.xhtml.input;
-
+
 import com.xpn.xwiki.XWikiContext;
 import com.xpn.xwiki.objects.BaseCollection;
 import com.xpn.xwiki.objects.BaseProperty;
@@ -43,8 +46,11 @@
     public BaseProperty fromString(String value) {
         if (value.equals("********"))
          return null;
-        else
-         return super.fromString(value);
+        else {
+            BaseProperty property = newProperty();
+            property.setValue(getPasswordDigest(value));
+            return property;
+        }
     }
 
     public void displayHidden(StringBuffer buffer, String name, String prefix, BaseCollection object, XWikiContext context) {
@@ -70,5 +76,26 @@
         input.setName(prefix + name);
         input.setSize(getSize());
         buffer.append(input.toString());
-    }
+    }
+   
+   public static String getPasswordDigest(String password){
+       try{
+           MessageDigest md5 = MessageDigest.getInstance("MD5");
+           md5.update(password.getBytes());
+           byte[] digest = md5.digest();
+           StringBuffer sb = new StringBuffer();
+           for (int j = 0; j < digest.length; ++j) {
+               int b = digest[j] & 0xFF;
+               if (b < 0x10) sb.append('0');
+               sb.append(Integer.toHexString(b));
+           }
+           return sb.toString();
+       }
+       catch(NoSuchAlgorithmException ex){
+           return password;
+       }
+       catch(NullPointerException ex){
+           return password;
+       }
+   }
 }
\ No newline at end of file
Index: com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImpl.java
===================================================================
--- com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImpl.java	(revision 1300)
+++ com/xpn/xwiki/user/impl/xwiki/XWikiAuthServiceImpl.java	(working copy)
@@ -22,26 +22,29 @@
 
 package com.xpn.xwiki.user.impl.xwiki;
 
+import java.io.IOException;
+import java.security.Principal;
+import java.util.List;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang.StringUtils;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.securityfilter.config.SecurityConfig;
+import org.securityfilter.filter.SecurityRequestWrapper;
+import org.securityfilter.realm.SimplePrincipal;
+
 import com.xpn.xwiki.XWiki;
 import com.xpn.xwiki.XWikiContext;
 import com.xpn.xwiki.XWikiException;
 import com.xpn.xwiki.doc.XWikiDocument;
+import com.xpn.xwiki.objects.classes.PasswordClass;
 import com.xpn.xwiki.user.api.XWikiAuthService;
 import com.xpn.xwiki.user.api.XWikiUser;
 import com.xpn.xwiki.web.Utils;
-import org.apache.commons.lang.StringUtils;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.securityfilter.config.SecurityConfig;
-import org.securityfilter.filter.SecurityRequestWrapper;
-import org.securityfilter.realm.SimplePrincipal;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-import java.security.Principal;
-import java.util.List;
-
 public class XWikiAuthServiceImpl implements XWikiAuthService {
     private static final Log log = LogFactory.getLog(XWikiAuthServiceImpl.class);
 
@@ -283,14 +286,9 @@
                 } finally {
                     context.setDatabase(db);
                 }
-            } else {
-                // error message was already set
-                return null;
             }
-        } else {
-            context.put("message", "loginfailed");
-            return null;
         }
+        return null;
     }
 
     protected String findUser(String susername2, XWikiContext context) throws XWikiException {
@@ -324,6 +322,7 @@
             // We only allow empty password from users having a XWikiUsers object.
             if (doc.getObject("XWiki.XWikiUsers") != null) {
                 String passwd = doc.getStringValue("XWiki.XWikiUsers", "password");
+                password = PasswordClass.getPasswordDigest(password);
                 result = (password.equals(passwd));
             }
 
