[Brad]

Originally Posted by dizzine

oh yeah sorry nexialys..
im still none the wiser as to the code/js needed..but im guessing providing someone knew the ftp user account details a form can be modded to provide a method of grabbing text pwds before they get hashed/compared..

so in essence regardless of how pwds are stored the only really important pwd is the admins ftp account..sheesh..!!

Well a proper modification would catch the plaintext version and hold it in memory until the user is logged in. If the user managed to log-in we know that password is good and we can store it somewhere for whenever it's needed.

The main problem with this is removing the bit of javascript in the navbar. You see it will hash the password on the client side before sending it off to the server (if the client has javascript on that is). This was done in the name of security...someone can't grab the plaintext version in-route to your server in other words.

I'm not interested in coding such a thing just because it doesn't catch my fancy but I'm sure some one around here would be willing to do it for you if you really wanted it.

You could always just hack out the hashing and store the passwords as plaintext in the database (you're doing it anyway in my above example ). But hey, wheres the fun in that?