Plaintext passwords
 

I am currently running vBulletin 2.0.3 and am unable to upgrade because I need to use mod_auth_mysql. This module allows me to use the forum logins for access to my other sites, but it will not work with PHP MD5 encrypted passwords used by current versions of vBulletin.

With the latest release of vBulletin fixing a security hole (I hate the idea of having a security hole on my server) I really need to upgrade. So if anyone knows how to convert vBulletin 2.2.3b to use plaintext passwords, please let me know.

Or better yet, if there are any C programmer gurus out there, maybe you can modify the mod_auth_mysql source to add the ability for it to use PHP MD5 encryption.

Mysql has a MD5() function. It generates the same string that the PHP MD5() function does for a given value.

I don't know how your scripts work but something like this would work:

SELECT userid FROM user WHERE username = '$username' AND password = MD5('$password')

So your saying to change mod_auth_mysql to use the MySQL MD5() function instead of the C crypt function? Don't know if my C knowledge is up to the task, but I'll look into it.

mod_auth_mysql has a MySQL encryption option, but I don't think this is the same as the MySQL MD5() function. I think I tried this option without success before, but I'll look into this again too.

I don't know anything about mod_auth_mysql but I assumed it allowed you to specify mysql queries via apache. I searched on dejanews for MD5 and mod_auth_mysql and found several hits that might be of assistance to you.