parsing username and password in usercp

[Lionel]

I added some third party software and it is sharing the vb user database info. I placed a link in the usercp that allows member to access his own photo album. Unfortunately that link presents you with a login form again and I'd like to make it a direct access. Since it is the same username and password, is there a way to parse it to the login form? I know that I could make use of hidden fields to simulate the login like:
<form method=post action="../othersoftware/login.php">
<input type="hidden" name="uidform" value="?">
<input type="hidden" name="password" value="?">
<input type="submit" name="submit" value="My Albums">
</form>

How can I create a template to do so?

Thank you.

[Admin]

For userid you can use $bbuserinfo[userid], for username $bbuserinfo[username], and for password $bbuserinfo[password].
Remember that the password will be in its 32-char hashed form (MD5()ed), so you'll need to make your script work with it.

[Lionel]

Actually I just found that too. I get the username and the MD5 password which is what the other script uses, but it is not being recognized. I think other script reads from letters than compares it with the string.

Exactly what I thought. I just tried in Dreamweaver by manually placing the password. I got in from desktop no problem.

So how do I parse the password in plain english?

[Admin]

You can't decode the password.
You need to adjust the other script to compare the passwords as they are, i.e not MD5ing it then comparing it with the value in the database.
Unless you use a different table and the passwords there are not encoded. In that case you will need to MD5 the value in the database when comparing:
SELECT [...] FROM tableName WHERE username=$username and MD5(password)=$password;

[Lionel]

here is how the other script does its routine after you put that password in plain English:

connectDB();
$uid = $uidform;
$result = queryDB( "SELECT uid, password, admin FROM $userinfo WHERE uid='$uidform' && status = '1'" );
$nr = mysql_num_rows( $result );

if ($nr > 0)
{
$row = mysql_fetch_array($result);
if ($uid == $row["uid"] and ( (md5($password) == $row["password"]) ) )
{
if($sysstatus == "1" || $row[admin] == "1")
{
Header ("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
Header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
Header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
Header ("Pragma: no-cache");

if($ref == "1" && $myref && !eregi("login.php", $myref))
$redurl = $myref;
else
$redurl = "$mainurl/user/index.php";

[Admin]

This is what you need to change:
if ($uid == $row["uid"] and ( (md5($password) == $row["password"]) ) )
if this script is only used with that form, you can just change it to this:
if ($uid == $row["uid"] and ( ($password == $row["password"]) ) )
(taken out the md5() function call)

If it is used in other places, it's a bit more complicated.

[Lionel]

I can always remove the other logins and limit access to control panel only.

[Lionel]

that works just fine.

[Lionel]

I copied login.php into login1.php and am using the altered one for usercp :p