Big Prbolem with "Your password is the same as your username"

[Ebi_P]

Hello,
i have an integrated Portal with Vbulletin Forum.
for some users it says
"Your password is the same as your username. This is no longer allowed."

which .php file need to modify to ignore this error and allow same username&password login?

Thanks

[Lynne]

I would strongly suggest against doing that. This was added when there were a series of accounts hacked because of this same username/password thing. I forget when it was, but at that time it seemed there were several threads started every day on vb.com from site owners who were getting spammed by accounts that were taken over do to this issue.

[Ebi_P]

Greetings Lynne,

Thank you for quick reply.

as i said, i have integrated Portal (VLDPersonals) with Vbulletin Forum. and i have been Disabled Registration on Forum because of registration only should be on Portal and my users can register on Portal and Autologin to froum too.

i have many users with same username&password and i really need to pass this error.
thanks

[Lynne]

OK, well... doing a Search in Phrases for "Your password is the same as your username." gives me the phrase "username_same_as_password". Doing a search in the 3.8 files for "username_same_as_password" gives me global.php around line 981. That is the code you want to modify.

[Ebi_P]

Thanks.

i found it but how should it modify?
i don't know which part must be start with // or another modification to resolve this problem:
=========================================

// password same as username?
if (!defined('ALLOW_SAME_USERNAME_PASSWORD') AND $vbulletin->userinfo['userid'])
{
// save the resource on md5'ing if the option is not enabled or guest
if ($vbulletin->userinfo['password'] == md5(md5($vbulletin->userinfo['username']) . $vbulletin->userinfo['salt']))
{
if ((THIS_SCRIPT != 'login' AND THIS_SCRIPT != 'profile') OR (THIS_SCRIPT == 'profile' AND $_REQUEST['do'] != 'editpassword' AND $_POST['do'] != 'updatepassword'))
{
eval(standard_error(fetch_error('username_same_as_ password',
$vbulletin->session->vars['sessionurl']
)));
}

===========================================

[Adrian Schneider]

Add this to ./includes/config.php: define('ALLOW_SAME_USERNAME_PASSWORD', true);

[Ebi_P]

Add this to ./includes/config.php: define('ALLOW_SAME_USERNAME_PASSWORD', true);


Hello SirAdrian,

Thanks in advance. it worked.
good Luck dear

[Lynne]

Add this to ./includes/config.php: define('ALLOW_SAME_USERNAME_PASSWORD', true);
I didn't know about that. Good to know! :up:

[Adrian Schneider]

NP.

Neither did I, but it was in the code he posted for us. :) Whenever you see constants used like that, it means you can just define them in config.php as a switch.

[James Birkett]

Might I recommend that now you've just publicly explained to us you're allowing users to use their username as a password; don't give out your forum URL :rolleyes:

@Adrian, I was just about to post that, you beat me to it :p

[Lynne]

Neither did I, but it was in the code he posted for us. :)
Ack! I guess I didn't look too closely at the specifics of the code. (Can I blame that on lack of coffee? Or on my frazzled nerves from dealing with my server this morning?)
Might I recommend that now you've just publicly explained to us you're allowing users to use their username as a password; don't give out your forum URL :rolleyes:
Hehe. Yeah, that would probably be smart.