vb.org Archive - Administrative and Maintenance Tools

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vBulletin 3.7 Add-ons (https://vborg.vbsupport.ru/forumdisplay.php?f=228)

- - Administrative and Maintenance Tools - Password Security Tools (https://vborg.vbsupport.ru/showthread.php?t=187980)

Quote:

Originally Posted by John (Post 1599437)

Try the attached passsec.php in the above post.

Thanks John, works great now!!! 12 out of 1,009 members isn't too bad I suppose :D

Great mod, thanks again for sharing it with us :)

Hi,

for some reason the phrase:

Code:

<phrasetype name="Access Masks" fieldname="accessmask">

                        <phrase name="username_cannot_equal_password" date="1218509082" username="John" version="1.0.0"><![CDATA[Your password cannot be the same as your username.]]></phrase>

                </phrasetype>

couldn`t be found and I had to add a new phrase with the same name for the product "vBulletin", phrase type "Error Messages" to make the error message appear in the user-registration dialogue.

all the best,
Sacha

Hi,

hm, is it correct that vBulletin doesn`t offer an option to set the min. password length? If so, could you add that as a feature for your mod?

all the best,
Sacha

Quote:

Originally Posted by sinucello (Post 1601200)

Hi,

hm, is it correct that vBulletin doesn`t offer an option to set the min. password length? If so, could you add that as a feature for your mod?

all the best,
Sacha

For some reason the vBulletin developers think that client-side hashing is a more valuable feature than being able to prevent poor quality passwords from being used by members. vBulletin's client-side hashing feature means that it's impossible to do any checks on the password, since it never reaches the server in clear text form. If someone intercepts your network traffic they can still gain access to your account using the md5 hash. The only protection offered is that in the rare event that this happens, the original clear text password won't be discovered. (Following the safe practice of using different passwords on different sites thwarts this.)

Anyway, the short answer is no - without disabling client-side md5 hashing it's impossible to check password length.

Hi,

Quote:

Originally Posted by John (Post 1602063)

Anyway, the short answer is no - without disabling client-side md5 hashing it's impossible to check password length.

thanks very much for your detailed answer. I added a password info-text, use your editable list of banned passwords and hope that someday the devs will change their minds.

all the best,
Sacha

finally vb will be adding this to there next release later this week (or next)

just curious now that vb implement this should this hack be required? or keep it as an extra secured feature?

VB doesn't check for common words.

Does this hack needs to be updated, now that vbulletin has implemented part of the functionality? I assume that they coded it in a different way than John did.

Is there or will there be, a password strength bar?

Hi,

Quote:

Originally Posted by Alfa1 (Post 1609059)

I just upgraded to 3.7.3 with this mod installed. Everything works but the "username/pw have to be unique" error message will appear twice. So I disabled the mod though vB doesn`t have the list of unwanted passwords feature.

hth,
Sacha

so vb does this now? what version?

From what i read in this thread it seems that this mod is better since it includes bad word list.

I looked up the vb update.

Quote:

Username=Password Disallowed

In this release, users will no longer be allowed to set their username and passwords to the same value. Users who already have a password that is the same as their username will be forced to change their password on their next login. Additionally, a tool has be added to the Admin Control Panel to email affected users with a new password. Please be aware of these potential compatibility changes when upgrading.

I still think that this mod is still better than what vb has done since they only addressed 1/2 the problem and since i haven't upgrade to 3.7.3 yet. I need to renew my vb membership.

I just wish there was a way to mandate a min password length on the forum.

Great mod John thank you for this.

Quote:

Originally Posted by LCN2007 (Post 1697999)

I looked up the vb update.

I still think that this mod is still better than what vb has done since they only addressed 1/2 the problem and since i haven't upgrade to 3.7.3 yet. I need to renew my vb membership.

I just wish there was a way to mandate a min password length on the forum.

Apologies for reviving such an old thread, but I just discovered this add-on and it works great with my 3.8.4 installation. However I wanted to do at least something to enforce a minimum password length, so I modified the verify_passwords javascript function in the register template (changes are in red):

Code:

<script type="text/javascript">

function verify_passwords(password1, password2, minlength)

{

        // do various checks, this will save people noticing mistakes on next page

        if (password1.value == '' || password2.value == '')

        {

                alert('$vbphrase[fill_out_both_password_fields]');

                return false;

        }

        else if (password1.value != password2.value)

        {

                alert('$vbphrase[entered_passwords_do_not_match]');

                return false;

        }

        else if (password1.value.length < minlength)

        {

                alert('Your password is too short. It has to be at least ' + minlength + ' characters');

                return false;

        }



        else

        {

                <if condition="$show['coppa']">

                pass_copy = password1.value;

                passconfirm_copy = password2.value;

                </if>



                var junk_output;



                md5hash(password1, document.forms.register.password_md5, junk_output, $show[nopasswordempty]);

                md5hash(password2, document.forms.register.passwordconfirm_md5, junk_output, $show[nopasswordempty]);



                <if condition="$show['coppa']">

                document.forms.register.password.value = pass_copy;

                document.forms.register.passwordconfirm.value = passconfirm_copy;

                </if>



                return true;

        }

        return false;

}

</script>

and immediately after in the same register template:

Code:

<form action="register.php?do=addmember" name="register" method="post" onsubmit="return verify_passwords(password, passwordconfirm, 8);">

the MOD states: "After confirming your email address is valid, we'll send you your new password." in an email to users, but I don't see anywhere how many characters the new/generated Password is. I assume it's a random mix of letters/numbers, but how l-o-n-g is the password it refers to?

Quote:

Originally Posted by MessageParis1 (Post 1980150)

That worked PERFECTLY, but I have one other question. If a user chooses to later revise their password via the UserCP (i.e. profile.php?do=editpassword function) then they are no longer held to an 8 Character Minimum Length password since this type CODE does not exist there. :(

Does anyone have an idea as to what additional CODE one would need to insert into the profile.php file to force users to always update their passwords using at least 8 characters? Or should such revisions be made in the modifypassword template?

Thanks a lot.It worked for me on 3.8.7.

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (3)bbcode_code_printable (7)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (16)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01266 seconds Memory Usage 1,766KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (3)bbcode_code_printable (7)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (16)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: