vb.org Archive - Has the Logout Hash algorithm changed?

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)

- - Has the Logout Hash algorithm changed? (https://vborg.vbsupport.ru/showthread.php?t=196245)

evannn

11-14-2008 08:46 AM

Has the Logout Hash algorithm changed?

We've set up a test server with the latest ver 3.7.4 I noticed the logout hash has changed.

At present, we are running on 3.6.8 and is running fine.

May I know what's the latest algo to generate logout hash?

Thank

Dismounted

11-14-2008 09:23 AM

Yes, the logout hash has changed in vBulletin 3.7.

Pre-3.7 Logout Hash

PHP Code:


		
			
$logouthash = md5($userid . $salt . $license);

3.7+ Logout Hash

PHP Code:


		
			
$logouthash = sha1($userid . sha1($salt) . sha1(COOKIE_SALT));

PHP Code:


		
			
$logouthash = $vbulletin->userinfo['securitytoken_raw'];

evannn

11-15-2008 04:18 AM

Many Thanks.

I suggest this thread be moved to the FAQ. Or, is the new algo change reflected inthe vBulletin manual?

Thanks

Dismounted

11-15-2008 09:19 AM

I do not believe any algorithms are in the manual in the first place.

evannn

11-17-2008 03:59 AM

How do you generate the value of "COOKIE_SALT"?

Dismounted

11-17-2008 04:03 AM

COOKIE_SALT is your license number. (NOT your customer number!)

evannn

11-17-2008 07:58 AM

Thanks Dismounted.

Are you able to confirm this is the correct mysql syntax for the new 3.7 algo? The result is vastly different.

Code:

select sha1(concat(user.userid,sha1( user.salt ),sha1('MYLICENSENUMBER'))) AS logouthash2 from user

I noticed the vB 3.7 generates the hash in this format: {Unix timestamp}-{Hash}

Is the unix timestamp any significant?
Thanks

Dismounted

11-17-2008 08:52 AM

Ah yes, I forgot about that. They actually changed the algorithm (again), in a later version. The algorithm I provided will work, but will not provide a time "expiry" check. The algorithm you mention is this ($rawhash being the result of the algorithm I gave you before):

PHP Code:


		
			
$tokenhash = TIMENOW . '-' . sha1(TIMENOW . $rawhash);

evannn

11-17-2008 09:11 AM

*strangles dismounted* . LOL!

Thanks!

Okay. Any insights on how to generate the constant TIMENOW?

I'm sure it's not as straight forward as mysql's UNIX_TIMESTAMP() nor php's time()

Dismounted

11-17-2008 09:29 AM

TIMENOW is just generated with time(). vBulletin uses TIMENOW to keep the time constant over the entire script's execution.

All times are GMT. The time now is 01:12 AM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01207 seconds Memory Usage 1,727KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (4)bbcode_php_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: