Apache 1.3 with mod_auth_mysql
 

Hi, our site has a gallery and the forum (using vbulletin 3.0.1). We
are using Apache 1.3 with mod_auth_mysql to protect the content of a
directory which is being served by the imagefolio script. We
password protected the gallery so that only registered members of our
forums can login (using the same username and password that they use to
login the forums) the gallery and download the files. Right now people can no longer login in the gallery by using their forum login info. We have no
problems in the past until we upgraded to vb 3.0.1.

What the vB developers are doing that's different is double-encrypting the password. It was encrypted previously (using MD5 - an encryption method) but only once. Now in version 3.0.1 they are doing something unusual by encrypting it twice.

May I ask if someone can shed some light on this? Thanks.

What was the previous vBulletin version you were on?

If you were on vBulletin 2, I'm not sure if that version did the "salting" for user authentication, but you might want to look into that (salt field is in the `user` table). Basically it takes the md5(md5(password) . salt).. last I checked (which was sometime ago, so I could be greatly mistaken).

vB2 didn't salt passwords, and yeah, I believe you're correct - it uses md5(md5(password) . salt).