jondrnek
06-10-2009, 10:00 PM
This mod allows you to run a program to change an external password file when the users changes their password.
For example, you can run htpasswd to change a password file that is used by .htaccess to control access to other web pages outside of vBulletin.
There are two new options in the control panel. One specifies the location of the password file. The other specifies that program used to change the password file.
I'm new to vBulletin and PHP so critiques are welcome.
Post any issue you have here (http://code.google.com/p/vbulletinpasswordfileupdater/issues/list?updated=3&ts=1244753256):
You may also need to edit a template to disable the MD5 hashing of the new password before it gets sent to the server. I did not need to do this on my dev server but I did on my production server.
Do that by going to
"Modify User Options Templates" and editing the "modifypassword" template. You will need to change line
md5hash(currentpassword, currentpassword_md5, junk_output, $show[nopasswordempty]);
to
md5hash(currentpassword_md5, junk_output, $show[nopasswordempty]);
You also need to go to "Registration Template" and edit the "register" template. You will need to change
md5hash(password1, document.forms.register.password_md5, junk_output, $show[nopasswordempty]);
md5hash(password2, document.forms.register.passwordconfirm_md5, junk_output, $show[nopasswordempty]);
to
md5hash(document.forms.register.password_md5, junk_output, $show[nopasswordempty]);
md5hash(document.forms.register.passwordconfirm_md 5, junk_output, $show[nopasswordempty]);
Version 1.0.1 has been released to fix a security hole.
Jon
For example, you can run htpasswd to change a password file that is used by .htaccess to control access to other web pages outside of vBulletin.
There are two new options in the control panel. One specifies the location of the password file. The other specifies that program used to change the password file.
I'm new to vBulletin and PHP so critiques are welcome.
Post any issue you have here (http://code.google.com/p/vbulletinpasswordfileupdater/issues/list?updated=3&ts=1244753256):
You may also need to edit a template to disable the MD5 hashing of the new password before it gets sent to the server. I did not need to do this on my dev server but I did on my production server.
Do that by going to
"Modify User Options Templates" and editing the "modifypassword" template. You will need to change line
md5hash(currentpassword, currentpassword_md5, junk_output, $show[nopasswordempty]);
to
md5hash(currentpassword_md5, junk_output, $show[nopasswordempty]);
You also need to go to "Registration Template" and edit the "register" template. You will need to change
md5hash(password1, document.forms.register.password_md5, junk_output, $show[nopasswordempty]);
md5hash(password2, document.forms.register.passwordconfirm_md5, junk_output, $show[nopasswordempty]);
to
md5hash(document.forms.register.password_md5, junk_output, $show[nopasswordempty]);
md5hash(document.forms.register.passwordconfirm_md 5, junk_output, $show[nopasswordempty]);
Version 1.0.1 has been released to fix a security hole.
Jon