Account Password Vulnerability - enhancing it more?

[Skyrider]

Account Password Vulnerability option in vB resets the passwords of those who has found to be vulnerable. It emails you a new password, yay! But is there anyway the password that is going to be send out is more enhanced? More characters, lower/bigger cases and symbols?

The passwords that were send and given by vbulletin though this feature is not that long, and i prefer it to be stronger by default.

[Digital Jedi]

I'm not sure about how to configure that without major(?) code changes, but the new password should only be used temporarily, and immediately changed by the user. Even it it sends them a more complicated one. In fact, the email should probably tell them this, if it doesn't already.

[HM666]

Maybe try this: https://vborg.vbsupport.ru/showthread.php?t=316017&highlight=password

If that is not what you are looking for then just do a search. Go to the search box at the top of the forum and use the word password as your search term then choose "All Mods" in the first drop down and then choose "Titles only" in the second one. That will give you several results to compare.

[Skyrider]

I saw that, but I'm looking for a way to give everyone a new password (mass force), but I prefer it having a hard password right away also for the inactive users.

[HM666]

Hmmmm I see the built in feature will not work for that either. You would probably nee a special plugin/code for that.

[kh99]

You could edit file includes/functions.php and change the function fetch_random_password(), but that's also used by the mobile api so I don't know what affect that would have. It's also a kind of strange function that generates a string of random characters but seems to have been modified to insert one digit in a random place or something like that.

Or you could edit admincp/passwordcheck.php and where fetch_random_password() is called, substitute your own code. That's where the vulnerable password check happens, if the user requests a change that's done in login.php.

[Skyrider]

Thanks for the hint KH. I've altered the line:

$password_characters = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz';

and I've included some symbols. Seems to work just fine!

However, when I alter:

function fetch_random_password($length = 8)
And change the lenght of the password to 12, doesn't appear to work. It sticks with giving a password length of 8.

[Dave]

That's because in admincp/passwordcheck.php around line 148 it calls the function with the number 8, that has priority over those default values.

[Skyrider]

That's because in admincp/passwordcheck.php around line 148 it calls the function with the number 8, that has priority over those default values.
Sweet, thanks! Now I receive awesome passwords now, the way I want it.

Last question though. When resetting a password through recovery (user recovery password), what controls the type of password there that will be send? I am unable to find password_characters under login.php, though I found fetch_random_password.

[kh99]

You should find a call to fetch_random_password(8) in login.php.

[Skyrider]

You should find a call to fetch_random_password(8) in login.php.
That, I can. But I'm unable to find the letters being used.

$password_characters = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz';

is not found in login.php, as such resetting passwords on the users end (normal recovery) isn't using the password characters through functions.php, I tried and it just gives a normal password with no new characters I added.

[kh99]

Oh, well, you don't find the string of letters there because they should only occur once, in fetch_random_password(), which is called from both places. But if you're not seeing the new chars when you request a password change, then there must be something else going on. I'll take a look and post back if you haven't figured it out by then.

[Skyrider]

I just searched all *.PHP files.. "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz" and or $password_characters is only called in functions.php, so currently no idea where else to look.

[kh99]

Oh, did you actually try requesting a password change? What I was trying to say is that the code in login.php should use the variable with the string of characters that you already changed, so it should change in both cases. If you want to increase the length then you should change login.php where it says fetch_random_password(8) (to something higher than 8).

[Dave]

You need to change the string in the fetch_random_password function because it's not a global variable.

[Skyrider]

Oh, did you actually try requesting a password change? What I was trying to say is that the code in login.php should use the variable with the string of characters that you already changed, so it should change in both cases. If you want to increase the length then you should change login.php where it says fetch_random_password(8) (to something higher than 8).
I've changed the password characters within functions.php
$password_characters = '123456789!@#$%^&*()ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz ';
Which appears to be working when I use the Check Vulnerable Passwords function. However, when I normally request a new password (forgotten password) for example, I still get the normal ABC,abc passwords, rather than the extra numbers and symbols I placed in.

EDIT!

Nvm! I spoke to soon. It appears to be working after all, thanks folks! :D

As you requested, your password has now been reset. Your new details are as follows:

Username: skytest
Password: 16%R&EG5pDt(UPX


Honestly, that sounds like a much better / secured password by default.