[dabean]

first all you need to fix a little bug in hack.

In member.php Find

PHP Code:

  // validate old password
  if ($currentpassword!=$bbuserinfo[password]) {
    eval("standarderror(\"".gettemplate("error_wrongpassword")."\");");
    exit;
  } 


above it add

PHP Code:

  // secure password mod - encrypt password
  if ($bbuserinfo[encryptedpass]==1) {
    $currentpassword=md5($currentpassword);
  } // end secure password mod 


now for the actual improvement.

File: member.php

Find...

PHP Code:

  if ($newpassword!=$newpasswordconfirm) {
    eval("standarderror(\"".gettemplate("error_passwordmismatch")."\");");
    exit;
  }

  // secure passwords
  if ($bbuserinfo[encryptedpass]==1) {
    $newpassword=md5($newpassword);
  }
  // end secure passwords 


replace it with

PHP Code:

  if ($newpassword!=$newpasswordconfirm) {
    eval("standarderror(\"".gettemplate("error_passwordmismatch")."\");");
    exit;
  }

  // secure passwords
  if ($encryption=="off" && $bbuserinfo[encryptedpass]==1) {
    $DB_site->query("UPDATE user SET encryptedpass=0 WHERE userid='$bbuserinfo[userid]'");
  } else {
    if ($bbuserinfo[encryptedpass]==1) {
      $newpassword=md5($newpassword);
    }
  }
  // end secure passwords 


Find

PHP Code:

  // secure passwords
  if ($bbuserinfo[encryptedpass]==1) {
    // md5 hash password & store todo
    $cryptpassword=1;
    $urltoforward=""
  } else { 


Replace with

PHP Code:

  // secure passwords
  if ($bbuserinfo[encryptedpass]==1 && $cryptpassword==0) {
    // md5 hash password & store todo
    $cryptpassword=1;
    $downgradepass=1;
  } else { 


Find

PHP Code:

  } else {      
      $goto="usercp.php?s=$session[sessionhash]";
  } 


replace with

PHP Code:

  } else {         // secure passwords
    if($downgradepass!=1) {
      $goto="usercp.php?s=$session[sessionhash]";
    } else {
      $goto="member.php?s=$session[sessionhash]&action=editpassword&encryption=off";
    }
  }           // end secure passwords 


now for the templates

template modifypassword
below
<input type="hidden" name="s" value="$session[sessionhash]">

add
<input type="hidden" name="encryption" value="$encryption">