[ckm]

I'm modifying this code to authenticate against something different, but I was looking through the code for this plugin and found a possible error.

In the section where it tries to update the VB database's user password, it seems to MD5 a password that's already MD5'd:

 
//MD5 the password with SALT key
$passwordsalt = md5($_POST[vb_login_md5password] . $salt[0]);

(BTW, line 89 in the XML file)

It may be my lack of understanding as to how VB holds passwords, but wouldn't you MD5 the plain text password, not something that's already been hashed? If so, would $vbulletin->GPC['vb_login_password'] still be available to do this?

And if $vbulletin->GPC['vb_login_password'] is still available, you could use it to replace $_POST[vb_login_md5password]

Thx.

Chris.