Quote:
Originally Posted by Marco van Herwaarden
Although not advised from a security POV, you can set 'DISABLE_PASSWORD_CLEARING' to true in your config.php, and the passwords will be passed to the server unencrypted.
|
Seems like a great step to what I need accomplished.
Though, since it would be now sent in plain text, would it be possible to call an SHA hash to compare against the SHA hash I have stored on the database (from SMF)? And then have that authenticate old users. And call an MD5 hash to compare against an MD5 hash stored in the database (from vBulletin).
Basically something like:
-capture pass in clear text
-sha hash it, if it matches the pw on the db allow login, else
-md5 hash it, if it matches the pw on the db allow login, else
-reject login credentials
I'm not interested in getting the passwords for my users per se, I'm interested in being able to compare old users passwords to their SHA hash from the old forum I was using and then (optionally) if that password works setting it to replace the pw field with the md5 hash so that eventually I could do away with the SHA hashing once everyone effectively gets their passwords md5'd. New users would simply work with the normal vBulletin hashing scheme and not have any issues.
I hope I'm conveying my need clearly, thanks for the directions thus far guys!